pyWhat
pyWhat identifies items such as email addresses and IPs from text or packet captures, according to its project description.
About pyWhat
pyWhat is an open source command-line tool that identifies what a piece of text or a file contains. It can identify items such as email addresses, IP addresses, URLs, and other structured data in text, files, and .pcap packet captures. The homepage gives examples including malware domains, phone numbers, credit card numbers, cryptocurrency addresses, and Social Security Numbers in pcap files.
The tool accepts a file path, a directory, or a text string as input, and it searches directories recursively. Several inputs can be passed in one run. Output can be filtered by category with the --include option, and results can be returned as a single JSON object with --json. It supports UTF-8, UTF-16, and UTF-32 text with a byte order mark, and it also searches UTF-16 strings inside binary files. The homepage describes an optional pip install with an optimize extra that may improve speed. Pricing is listed as unknown.
Key features
- Identifies emails, IP addresses, URLs, and other structured data in text or files
- Accepts file paths, directories, and text strings as input
- Processes several files, directories, or text strings in a single run
- Reads UTF-8, UTF-16, and UTF-32 text, and UTF-16 strings inside binary files
- Filters output by category, such as Bug Bounty, using the --include option
- Returns results as one JSON object with the --json option
Best for: Security researchers and analysts who need to scan text, files, or .pcap captures for identifiable items such as emails, IP addresses, or API keys.
Good for
- Open source, with the source code available in a public GitHub repository
- Accepts .pcap files, plain text, and directories of files as input
- Provides JSON output for use in other scripts or tools
pyWhat at a glance
- Website
- github.com/bee-san/pyWhat
- Category
- Privacy & Security › Security Tools
- Type
- Open-source project
- Pricing
- Not confirmed. Check the site
- Open source
- Yes · Source code
- Language
- English
- Last checked
- Oct 6, 2026 · Online when checked
- Listed
- Oct 5, 2026
Guides for Security Tools
pyWhat alternatives
Tools and sites you could use instead, ranked by how closely they match.
Browse community-maintained materials and plugins for the Ghidra reverse engineering framework.
Analyze software with Cutter, an open-source reverse engineering platform powered by Rizin.
Free
24 alternatives
Use reference sheets for reverse engineering, binary analysis, and assembly programming tools.
Open source
24 alternatives
Set up a Windows virtual machine for reverse engineering with FLARE-VM’s software installation scripts.
Open source
24 alternatives
Browse Android reverse engineering training, tools, and learning resources in this curated repository.
Open source
24 alternatives
dnSpyEx continues the dnSpy project as a debugger and assembly editor for .NET.
Open source
24 alternativesPopular in Security Tools
Well-known listings from the same topic.
Online Password Hash Crackonlinehashcrack.comOTP Authapps.apple.com/app/otp-auth/id659877384MD5 reverse lookupmd5.gromweb.comMozilla SSLssl-config.mozilla.orgchallenges.rechallenges.reGoPlus Locker V3gopluslabs.io
pyWhat FAQ
How do I install pyWhat?
Install it with pip3 install pywhat. The homepage also lists a Homebrew command for Mac (brew install pywhat) and a MacPorts command (sudo port install pywhat).
Can pyWhat scan a whole directory?
Yes. When given a directory, pyWhat recursively searches for files and outputs the results.
How do I limit results to bug bounty items?
Run pywhat --include "Bug Bounty" TEXT, or use the same filter when scanning files. Running pywhat --tags lists the other available filters.
Is something wrong or out of date?
Tell us and an editor will check it.
Own this website?
Claim this listing
Claim the listing and suggest updates yourself. An editor checks every claim first.