Hash matching

Hash matching turns an image or video into a short fingerprint and compares it with lists of fingerprints of known illegal material, such as child sexual abuse material (CSAM). A match points to a copy, or a near copy, of something already identified. It cannot judge new content, which is what classifiers do, so platforms often need both. Detectivision does not offer hash matching.

How it works

A hash function turns a file into a short value, its hash. Two kinds matter here:

• Cryptographic hashes, such as MD5, SHA-1 and SHA-256, change completely when one byte changes, so they match only exact copies.
• Perceptual hashes, such as PhotoDNA and PDQ, are computed from what the image looks like, so a resized or re-saved copy gets a nearby hash. Two hashes match when the distance between them is under a chosen threshold.

Microsoft says PhotoDNA "creates a unique digital signature (known as a 'hash') of an image which is then compared against signatures (hashes) of other photos to find copies of the same image". It "is not facial recognition software", and its hash "is not reversible". Meta's PDQ, open source under a BSD licence since 2019, is "a perceptual hasher: it tries to match images which people perceive as similar". Its README suggests starting with a match distance of 31 or less, then testing thresholds on your own data.

How much change a match survives differs by algorithm. The IWF says its PhotoDNA hashes still match an image that was "resized, cropped or colours changed". Meta's documentation says PDQ does well with JPEG-to-PNG conversion and lower JPEG quality, but not when one photo is a crop of another.

On an upload, the flow is:

1. Compute the file's hashes.
2. Look them up in the lists you have access to: an exact lookup for cryptographic hashes, a nearest-match search within your distance for perceptual ones.
3. On a match, block the upload, and preserve and report it as the law that applies to you requires.
4. With no match, the file goes on to your other checks, such as classifiers and user reports. A miss says nothing about whether new material is harmful.

Who keeps the lists, and who can use them

Thorn adds that companies "must adhere to their national reporting mandates", and that it "does not report on a company's behalf".

Hashes and classifiers

Specialist providers pair the two. Safer offers hash matching for known CSAM and a classifier that "identifies potentially novel image and video CSAM". General moderation APIs are a different tool. Microsoft says of its own: "You cannot use Content Moderator to detect illegal child exploitation images. However, qualified organizations can use the PhotoDNA Cloud Service to screen for this type of content."

Where laws mention it

• Turkey. Law 5651, Turkey's Internet Law, gains a new paragraph on 1 November 2026: Additional Article 4, paragraph 23 (ek 4/23), added by Law 7578. It applies to social network providers (sosyal ağ sağlayıcı: services that let users create, view or share content such as text, images and sound to interact) with more than 10 million daily accesses from Turkey. They must take every necessary measure so that content covered by a removal or access-blocking decision under Law 5651 is not published on their site. The law names no method; hash matching against the removed files is one way platforms find re-uploads.
• UAE. Federal Decree-Law No. 26 of 2025 on Child Digital Safety, in force since 1 January 2026, applies to digital platforms that operate in the UAE or target users there. In Latham & Watkins' summary, "Immediate reporting of child pornography or harmful content involving children to concerned entities is mandatory", and "AI systems for proactive detection and removal" are required. The summary does not mention hash matching.
• UK. Under the Online Safety Act 2023, Ofcom, the online safety regulator, writes codes of practice. The government's explanatory memorandum of 17 December 2024 says the illegal content codes include "measures on automated tools to detect CSAM". A memorandum of 18 June 2026 refers to amendments laid on 1 June 2026 "relating to hash-matching for non-consensual intimate images". Ofcom's codes set out which services each measure covers.

What Detectivision does and does not do

Detectivision's image flags are hate, scam, sexual and violence, and each judges the whole image. It does not:

• match hashes or hold any hash list;
• detect CSAM: a sexual flag says an image is sexual, not anything about anyone's age;
• estimate age (age assurance);
• report to NCMEC, the IWF or any authority;
• stop removed files from being uploaded again.

If your platform needs hash matching, go to the providers above; their access rules apply. To classify new images for sexual content and violence, which is a different job from finding CSAM, see NSFW detection, or talk to us.