# pyWhat: identifying structured patterns in text, files and network captures

> pyWhat is a MIT-licensed Python CLI that runs named regex patterns over text, files, directories and pcap captures to label emails, crypto addresses, API keys, SSNs and more. The rarity score built into each pattern is the mechanism that separates useful matches from noise, and tuning it is the first thing to understand before you rely on the output.

**bee-san/pyWhat** — 🐸   Identify anything. pyWhat easily lets you identify emails, IP addresses, and more. Feed it a .pcap file or some text and it'll tell you what it is! 🧙‍♀️

- Repository: https://github.com/bee-san/pyWhat
- Stars: 7,326 · Forks: 393
- Language: Python
- License: MIT
- Published: 2026-10-11 · Updated: 2026-10-11 · Language: en
- Canonical page: https://hysenlabs.com/projects/bee-san-pywhat

## Text, files and pcap captures all feed into the same regex library

pyWhat solves one problem: you have a blob of text, a file, or a network capture, and you need to know what named patterns are in it. It identifies emails, IP addresses, URLs, phone numbers, credit card numbers, social security numbers, cryptocurrency addresses, API keys, webhooks and more, by running each input against a library of named regex patterns and returning a label and a rarity score for each match. The README covers three concrete use cases: malware analysis, pcap inspection, and bug bounty scanning for credentials and API keys.

The tool ships two CLI entry points, pywhat and what, and a Python API. Both names install together and either works. The Python API is documented at https://github.com/bee-san/pyWhat/wiki, the URL registered in the package metadata under the documentation key.

The repository holds a pywhat/ directory alongside tests/, fixtures/, and a scripts/ directory. Runtime dependencies are click ^8.0.0 and rich >=11.0.0. An optional orjson package at ^3.6.1 is available through the optimize extra. The pyproject.toml sets the minimum Python version at ^3.7.

## The rarity score that sets the default output threshold at 0.1

Each regex in pyWhat carries a rarity value between 0 and 1. The 0.1 default is a filter against coincidental matches: any pattern short enough to appear randomly in arbitrary text scores below it, and pyWhat suppresses those by default.

A YouTube video ID illustrates the cut-off. Eleven characters fit too many patterns to score above 0.1 on their own, so what dQw4w9WgXcQ returns nothing. Adding the host name and path to form a full URL like https://youtu.be/dQw4w9WgXcQ brings the match above the threshold, because that URL structure is specific enough to distinguish itself.

The rarity range runs from 0 to 1. You control the window with --rarity 0.2:0.8, which returns only patterns scoring between 0.2 and 0.8. Setting the lower bound to 0 with --rarity 0: opens the floor completely, at the cost of seeing matches that are almost certainly coincidental.

Sorting is available with -k rarity --reverse to order output from least to most rare. The --top 10 flag keeps only the ten highest-rarity matches across all inputs, and --top 5% keeps the top 5 percent. For a directory or a large pcap with many results, these flags are the practical way to stay focused on the strongest candidates. Fragments of a longer word found in boundaryless mode are less likely than the full match, so --top 1 on an Ethereum address string shows the address rather than the card and SSN patterns embedded within it.

## Installing with pip3, Homebrew or MacPorts and running the first check

Four install paths are listed. For most users on any platform, the pip route is the starting point:

```bash
pip3 install pywhat
```

The optimize extra installs orjson, an optional dependency the pyproject.toml lists under extras for speed improvements:

```bash
pip3 install pywhat[optimize]
```

For macOS, two package manager options are listed. Homebrew users can run:

```bash
brew install pywhat
```

MacPorts users have a separate command:

```bash
sudo port install pywhat
```

After installing, pass a suspicious string directly to confirm the tool is working. The README uses an Ethereum address as its example:

```bash
what "0x52908400098527886E0F7030069857D2E4169EE7"
```

pyWhat identifies it as an Ethereum address. The pyproject.toml names both pywhat and what as script entry points, both mapping to pywhat.what:main. Running what --help prints the full option list for the version installed.

A Dockerfile is included in the repository for those who prefer a container. It uses python:3.10-alpine as its base, installs git, installs pyWhat from git+https://github.com/bee-san/pyWhat, removes git, sets the WORKDIR to /workdir, and uses python -m pywhat as its ENTRYPOINT.

## Filtering output with --include, --exclude and tag combinations

The default output covers every match above the rarity threshold. When you care only about a subset, the --include and --exclude flags narrow the results. Running pywhat --tags prints every available filter category. Running pywhat --names prints every regex name along with shorter alternative names.

To scan for bug bounty candidates such as API keys, webhooks and credentials, the README gives this command:

```bash
pywhat --include "Bug Bounty" TEXT
```

You can combine categories with a comma to include multiple at once:

```console
pywhat --include "BTC Wallet,ETH Wallet" TEXT
```

The --exclude flag removes a category from the output. To see all cryptocurrency wallet matches except Ripple:

```console
pywhat --include "Cryptocurrency Wallet" --exclude "Ripple Wallet" 1KFHE7w8BhaENAswwryaoccDb6qcT6DbYY
```

Regex names have shorter aliases. BTC Wallet is a shorter alternative name for Bitcoin (₿) Wallet Address, and ARN is short for Amazon Resource Name (ARN). Both forms work in --include and --exclude arguments. The full list is accessible with pywhat --names after installation.

## PCAP analysis and the domain identification approach from Wannacry

A .pcap file from a network incident can be passed directly to the CLI. From such a capture, identifiable patterns can include URL strings, email addresses, phone numbers, credit card numbers, cryptocurrency wallet addresses and social security numbers, provided those patterns appear in the capture and score above the rarity threshold.

The Wannacry example in the README explains how identification fits into a broader workflow. Wannacry had a kill-switch domain hardcoded into its code, and registering that domain stopped the virus. Running what over the malware binary to surface all embedded domains was the described step, after which a domain registrar API handled the registrations. pyWhat's role is the identification step only, not the action that follows.

For a network capture from an incident, passing the file to the CLI returns labeled artifacts without opening the capture in a full packet analyzer. That is a narrower view than what Wireshark or tcpdump show. pyWhat finds named patterns in the text content of what the capture contains. It does not parse packet headers, reconstruct TCP sessions, or decode protocol-layer fields.

## Files, directories, Unicode strings in binaries and the --json flag

You can pass a file path, a directory, or raw text strings in any combination on a single command line. Directories are searched recursively. Multiple inputs go together:

```bash
what file1 file2 this/is/a/directory 'some text'
```

For looping over a set of files with find:

```bash
find . -name '*.log' -exec what {} +
```

The --json flag returns all results in a single JSON object. Each match includes the file path it came from, and matches in literal text input appear under the key text. This separation matters when you mix files and strings on one command line, because it tells you which source produced each result.

Binary files from Windows store most text as UTF-16 strings, the same content that strings -el extracts. pyWhat scans those strings and interprets their encoding, so a Windows executable or DLL is a valid input alongside plain text files. Input can also carry a byte order mark for UTF-16 or UTF-32, covering the file format that Windows saves as Unicode text. Characters that cannot display in the terminal become escape sequences such as \u20bf rather than causing a crash.

## What pyWhat adds over grep and strings for binary and capture analysis

grep matches text against patterns you supply and returns the lines that match, with no label and no rarity score. Writing the patterns yourself means knowing in advance what you are looking for. When you have an unknown binary or a capture full of mixed content and want to discover what categories of data are in it, grep requires that you already know the answer.

The strings utility, which the README references explicitly in its Unicode section, extracts printable strings from binary files. It does not identify what those strings are. pyWhat adds the identification layer: rather than showing the raw string, it shows a label such as Ethereum Address or Amazon Resource Name.

The cost of the library approach is that coverage depends entirely on what patterns are in it. grep with a custom pattern finds anything you can write a regex for. pyWhat finds only what its library covers, and the pattern definitions live in the pywhat/ directory of the repository. Running pywhat --names after installation is the only reliable way to confirm that the specific pattern you need is present at the version you have installed.

## Version 5.1.0 is the last tagged release and dates to 2021-12-04

The most recent tagged release is 5.1.0, published on 2021-12-04, with a title of New & Better regex. Before it came 5.0.0 on 2021-10-22 and 4.3.1 on 2021-10-10. No release has been tagged since December 2021, but the main branch last received a push on 2026-10-05. The pyproject.toml version field reads 5.1.0, and installing from PyPI pins you to that version.

The Dockerfile in the repository installs from git+https://github.com/bee-san/pyWhat, which pulls whatever the main branch contains at build time rather than the 5.1.0 PyPI release. No CHANGELOG file or HISTORY file appears in the repository's root listing, and no release note covers the period from December 2021 to the 2026-10-05 push, so the changes during that interval are not documented in the repository's accessible files.

The license is MIT, named in both the pyproject.toml and the repository metadata. CONTRIBUTING.md at the repository root describes how to contribute. A Discord link appears in the README alongside the PyPI badge and the Python version badge. The documentation wiki at https://github.com/bee-san/pyWhat/wiki is the URL the package metadata registers as the documentation entry point.

## Conclusion

pyWhat fits security analysts and bug bounty researchers who need a quick first pass over text blobs, downloaded files or pcap captures, and who want a labeled output rather than raw regex matches. Skip it if you need to parse packet headers or protocol structure, authenticate to a target, or identify patterns not in its library. Before adopting it for a workflow, run pywhat --names to see every pattern available at the version you have installed, then test against a file where you already know what identifiable strings are present, to verify the rarity threshold is placed where you need it.

## FAQ

### What does pyWhat identify?

pyWhat identifies emails, IP addresses, URLs, phone numbers, credit card numbers, social security numbers, cryptocurrency addresses, API keys, webhooks and more, by matching input against a library of named regex patterns. Run pywhat --names to see every pattern name and its alternatives at the version you have installed.

### What Python version does pyWhat require?

The pyproject.toml sets the minimum Python version at ^3.7. Runtime dependencies are click ^8.0.0 and rich >=11.0.0, with orjson ^3.6.1 available as an optional dependency under the optimize extra.

### Can pyWhat scan .pcap files?

Yes. You pass a .pcap file path directly to the what or pywhat command. pyWhat identifies structured patterns in the capture content, including URLs, emails, phone numbers, credit card numbers, cryptocurrency addresses and social security numbers.

### How does the rarity score work in pyWhat?

Each regex pattern carries a rarity value between 0 and 1. By default, pyWhat shows only matches with a rarity of 0.1 or higher because lower-scoring matches are often false positives. You adjust the range with the --rarity flag, such as --rarity 0.2:0.8 or --rarity 0: to open the floor entirely.

### Is pyWhat available on Homebrew or MacPorts?

Yes. The README lists brew install pywhat as the install path for macOS Homebrew users, and sudo port install pywhat for MacPorts users. pip3 install pywhat works on all platforms.

## Sources

- [bee-san/pyWhat on GitHub](https://github.com/bee-san/pyWhat)
- [Issues](https://github.com/bee-san/pyWhat/issues)
- [License: MIT](https://github.com/bee-san/pyWhat/blob/main/LICENSE)
- [README](https://github.com/bee-san/pyWhat/blob/main/README.md)
- [Releases](https://github.com/bee-san/pyWhat/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/bee-san-pywhat