pyWhat is a command-line tool that identifies data types and patterns in text and files, including emails, IP addresses, hashes, cryptocurrency wallets, and more.
The tool solves the problem of quickly determining what an unknown piece of data represents without manual analysis. It works by accepting text input or file paths and running pattern-matching algorithms against a collection of identifiers for common data types. The tool is recursive, meaning it will scan through text to find and identify multiple patterns within the same input. It can also process pcap files and supports filtering results by category using include and exclude flags.
pyWhat suits security researchers, malware analysts, and bug bounty hunters who frequently encounter unidentified data during investigations. It is particularly useful for anyone working with network traffic captures or processing large volumes of text where manual identification would be time-consuming. The tool is designed for quick command-line usage and can be integrated into shell scripts and automated workflows. The README does not make explicit comparisons to alternative tools.
The project maintains active community engagement through a Discord server. Development shows responsiveness to user needs, with the codebase accepting contributions and supporting optional dependency installation for performance improvements. The tool is distributed through standard Python package management channels, making it accessible to the target audience of security professionals.
