OTInstaller
Sign in

image-hash

v0.1.0Verified publisher

Computes perceptual hashes of an online image to match copies and near-duplicates

Community-packaged from github.com/osintverse-community/image-hash: the registry's community pins the upstream release; the tool is its authors' work. Maintain that project? Claim this package.

Run

Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).

{"tool":"osintverse-community/image-hash","target":"https://raw.githubusercontent.com/ianare/exif-samples/master/jpg/gps/DSCN0010.jpg","input_type":"url"}

Or just say: "Run osintverse-community/image-hash on https://raw.githubusercontent.com/ianare/exif-samples/master/jpg/gps/DSCN0010.jpg with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.

ot run osintverse-community/image-hash url:https://raw.githubusercontent.com/ianare/exif-samples/master/jpg/gps/DSCN0010.jpg --format table
ot install osintverse-community/image-hash

Docker image in a read-only container · network allowed · no key · up to 2 min. The first ot run installs the tool after asking once. The example value is the registry's own test input, so this command has run. Drop --format table for JSON.

Don't have ot? Install it in one line
curl -fsSL https://get.otinstaller.com/ot | sh
What this script does
  1. Downloads the latest ot release for your machine from GitHub Releases.
  2. Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
  3. Puts ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.
irm https://get.otinstaller.com/ot.ps1 | iex
What this script does
  1. Downloads the latest ot release for your machine from GitHub Releases.
  2. Checks its SHA-256 against checksums.txt, and the Ed25519 signature on that file against the key built into the script.
  3. Puts ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.

Evidence

Security tab →
  • Pinnedimage sha256:588a79f1…185017. The same bytes on every install; ot pulls by digest, never by tag.
  • Signedby https://github.com/osintverse-community/image-hash/.github/workflows/otinstaller-release.yml@refs/heads/main via token.actions.githubusercontent.com, verified by the registry on 20 Oct 2026. ot checks the same identity before every install and refuses another signer.
  • Scanned20 Oct 2026: 0 critical, 44 high, 63 medium, 62 low vulnerabilities; 0 embedded secrets, 0 malware heuristics; SBOM with 94 packages.
  • Workssmoke test passed on 20 Oct 2026 (exit 0 in 3.0 s, offline sandbox); the nightly health check passed (today).
  • Backed upa copy of this image is on the registry's mirror. If the original registry refuses it, ot pulls the same digest from the mirror and checks the same signature.
  • Reviewedosintverse-community is a verified publisher: the registry confirmed who runs it, and a person reviewed its first release against the acceptable-use rules.

What you get back

Result envelope →
{
  "envelope": 1,
  "tool": "osintverse-community/image-hash@0.1.0",
  "runtime": "docker",
  "input": {
    "url": "https://raw.githubusercontent.com/ianare/exif-samples/master/jpg/gps/DSCN0010.jpg"
  },
  "started_at": "2026-10-21T09:00:00Z",
  "duration_ms": 4100,
  "exit_code": 0,
  "entities": [
    {
      "type": "image",
      "value": "https://example.com/photo.jpg",
      "attrs": {
        "phash": "8f373714acfcf4d0"
      }
    }
  ],
  "warnings": []
}

Every tool returns this shape, shaped here from what this tool declares it finds. --format table to read it; ot extract and ot auto to continue.

image-hash

Downloads an image and computes its average, perceptual, difference, wavelet and colour hashes, plus the SHA-256 of the exact file. Perceptual hashes stay nearly the same when a picture is resized, recompressed or lightly edited, so they show whether two images are the same photo.

ot run osintverse-community/image-hash --url https://example.com/a.jpg --compare https://example.org/b.jpg

Inputs

Input Required
url yes URL of the image
compare no URL of a second image to compare with

Notes

With --compare, the second image carries the Hamming distance for each hash; a pHash distance of 8 or less usually means the same picture. Crops and mirror images change the hashes a lot.

Next steps

Search the web for copies with osintverse-community/reverse-image-links.

Development

pip install ImageHash==4.3.2 Pillow==13.0.0
python -m unittest
ot validate

Releases are built, signed and published by the otinstaller release workflow (Actions tab, with the version to release).

License

MIT

Guides using this tool

Other url tools

All url tools →

Alternatives to image-hash that also take an url; ot auto runs every installed one on the same value.

osintverse-community/gallery-dl

Lists the images and metadata of posts and galleries on Reddit, Flickr, Imgur, Tumblr and 300+ sites

Takes url → finds image, other, url
No key · Python wheel
Worked todayVerified publisher

osintverse-community/tldextract

Splits a URL or hostname into subdomain, registered domain and public suffix

Takes url → finds domain, subdomain
No key · Python wheel
Worked todayVerified publisher

osintverse-community/unfurl

Breaks a URL into everything it encodes: timestamps, IDs, search terms, tracking and session data

Takes url → finds other
No key · Python wheel
Worked todayVerified publisher

osintverse-community/waybackpy

Finds the oldest or newest Wayback Machine capture of a URL, or every archived URL of a site

Takes url → finds url
No key · Python wheel
Worked todayVerified publisher

osintverse-community/yt-dlp

Extracts metadata from videos and channels on YouTube, TikTok, X, Instagram and 1,000+ other sites

Takes url → finds account, other, url
No key · Python wheel
Worked todayVerified publisher
Esc

Try

↑ ↓ to move↵ to open