# Gravatar alternatives in 2026 > Gravatar only knows people who signed up for it. Here are the alternatives for getting a profile picture from an email address, and when each one fits. Published 2026-10-19 ยท https://avatarsapi.com/blog/gravatar-alternatives [Gravatar](https://docs.gravatar.com/) is still the default answer to "show a picture for this email address". It is free, fast, and built into WordPress. Its limit is coverage: it only has a picture for people who uploaded one to Gravatar, which is mostly WordPress users and developers. For everyone else you get a default image. This post covers the alternatives as of October 2026, grouped by what you actually need. ## How Gravatar works today You hash the trimmed, lowercased email and request `https://gravatar.com/avatar/`. Gravatar's docs now say to use SHA-256 rather than MD5 ([docs](https://docs.gravatar.com/rest/api-data-specifications/)), and WordPress core switched in 2024. Sizes go up to 2048 px, and `d=` picks a default such as `initials`, `identicon`, or `404`. Two things to know: - **The hash is not privacy.** An unsalted SHA-256 of an email can be reversed by guessing likely addresses, just like MD5 could. - **The profile API is separate.** `api.gravatar.com/v3` returns profile data, limited to 100 requests per hour without a key and 1,000 with one ([docs](https://docs.gravatar.com/rest-api/)). Image requests are not rate limited the same way. ## If you want better coverage for an email: check more than Gravatar **avatarapi** treats Gravatar as one Source among several. `https://avatarsapi.com/email/jane@example.com` races Gravatar and GitHub, then falls back to the domain's [BIMI](https://bimigroup.org) logo, so a work email from a company with a verified brand logo still gets an image. Every candidate is fetched and validated, so a 404 means nobody had a real picture, not that you got a silhouette. ```html ``` The same API also takes usernames on 72 platforms (`/github/:user`, `/x/:user`, `/twitch/:user`) and domains, which is handy when your records have a mix of identifiers. [Docs](https://avatarsapi.com/docs). **unavatar** ([docs](https://unavatar.io/docs)) works the same way, with `/email/:address` checking Gravatar and other providers. Its free tier requires attribution and is limited per IP per day. **AvatarAPI.com** ([site](https://www.avatarapi.com/)) is a server-side JSON API that looks up a name and photo for an email across Google, Microsoft, LinkedIn, and others, priced per call. It fits enrichment jobs in a CRM rather than `` tags in a UI. ## If you want a federated, open-source Gravatar: Libravatar [Libravatar](https://wiki.libravatar.org/api/) uses the same hashing scheme (MD5 or SHA-256), lets a domain host its own avatars through DNS, and redirects to Gravatar when it has nothing. It is a good fit for open-source communities that do not want to depend on Automattic, but it adds no coverage of its own beyond its users. ## If you just want something nice when there is no photo: generate one [DiceBear](https://www.dicebear.com/how-to-use/http-api/), [UI Avatars](https://ui-avatars.com/), [Boring Avatars](https://github.com/boringdesigners/boring-avatars), and [avatar.vercel.sh](https://github.com/vercel/avatar) generate an avatar from a seed or a name. They never fail, but they are never the person's real face. They work best as the fallback behind a real lookup: ```html ``` Note that DiceBear's hosted API is free for non-commercial use only; commercial apps are asked to self-host it. ## Summary | Need | Use | | --- | --- | | Free, standard, only for people with a Gravatar | Gravatar | | Real photo from more than Gravatar, in an `` | avatarapi or unavatar | | Name and photo enrichment on the server | AvatarAPI.com | | Self-hosted or federated | Libravatar | | Never-failing placeholder | DiceBear, UI Avatars, Boring Avatars | Facts about third-party services are from their own documentation as read on October 19, 2026.