Gravatar alternatives in 2026

Gravatar is still the default answer to "show a picture for this email address". It is free, fast, and built into WordPress. Its limit is coverage: it only has a picture for people who uploaded one to Gravatar, which is mostly WordPress users and developers. For everyone else you get a default image.

This post covers the alternatives as of October 2026, grouped by what you actually need.

How Gravatar works today

You hash the trimmed, lowercased email and request https://gravatar.com/avatar/<hash>. Gravatar's docs now say to use SHA-256 rather than MD5 (docs), and WordPress core switched in 2024. Sizes go up to 2048 px, and d= picks a default such as initials, identicon, or 404.

Two things to know:

• The hash is not privacy. An unsalted SHA-256 of an email can be reversed by guessing likely addresses, just like MD5 could.
• The profile API is separate. api.gravatar.com/v3 returns profile data, limited to 100 requests per hour without a key and 1,000 with one (docs). Image requests are not rate limited the same way.

If you want better coverage for an email: check more than Gravatar

avatarapi treats Gravatar as one Source among several. https://avatarsapi.com/email/jane@example.com races Gravatar and GitHub, then falls back to the domain's BIMI logo, so a work email from a company with a verified brand logo still gets an image. Every candidate is fetched and validated, so a 404 means nobody had a real picture, not that you got a silhouette.

<img src="https://avatarsapi.com/email/jane@stripe.com?size=80" alt="">

The same API also takes usernames on 72 platforms (/github/:user, /x/:user, /twitch/:user) and domains, which is handy when your records have a mix of identifiers. Docs.

unavatar (docs) works the same way, with /email/:address checking Gravatar and other providers. Its free tier requires attribution and is limited per IP per day.

AvatarAPI.com (site) is a server-side JSON API that looks up a name and photo for an email across Google, Microsoft, LinkedIn, and others, priced per call. It fits enrichment jobs in a CRM rather than <img> tags in a UI.

If you want a federated, open-source Gravatar: Libravatar

Libravatar uses the same hashing scheme (MD5 or SHA-256), lets a domain host its own avatars through DNS, and redirects to Gravatar when it has nothing. It is a good fit for open-source communities that do not want to depend on Automattic, but it adds no coverage of its own beyond its users.

If you just want something nice when there is no photo: generate one

DiceBear, UI Avatars, Boring Avatars, and avatar.vercel.sh generate an avatar from a seed or a name. They never fail, but they are never the person's real face. They work best as the fallback behind a real lookup:

<img
  src="https://avatarsapi.com/email/jane@stripe.com"
  onerror="this.onerror=null; this.src='https://ui-avatars.com/api/?name=Jane+Doe'"
  alt="">

Note that DiceBear's hosted API is free for non-commercial use only; commercial apps are asked to self-host it.

Summary

Facts about third-party services are from their own documentation as read on October 19, 2026.