gravatar.com

Yes — Gravatar is built around a privacy-first design, and you decide what appears on your profile. You can make your profile private or choose which parts to share and when. Because Gravatar ties an identity to an email address rather than a name, you can also run separate work, personal, and anonymous profiles. The trade-off is that anything you mark public is meant to be seen across the web, so the real control comes from how you configure each profile.

How Gravatar's privacy model works

Gravatar describes its approach as "Privacy First Design": your data is yours, and you're in control. In practice, that means two layers of control:

• Profile-level visibility — you can make a profile private, or choose what you share and when.
• Identity-level separation — an identity is linked to an email address, not your name, so different email addresses can map to different profiles.

That second point matters more than it first appears. If your work email and a personal email each have their own Gravatar profile, the two don't have to look related. You can present a professional identity on one and an anonymous or hobby identity on another.

What you actually control

The core promise is "Update Once, Sync Everywhere": when you change your avatar or profile, the update appears across the platforms that use Gravatar. That's convenient, but it also means a public change is a public change — the same edit propagates widely.

Why the email-based identity matters for privacy

Gravatar's "Manage Multiple Identities" feature exists precisely because identity is anchored to an email address. This gives you a practical way to separate contexts:

• Work profile — professional bio, company links, a headshot.
• Personal profile — the identity friends and communities see.
• Anonymous profile — an identity that isn't tied to your real name.

Because the link is email-based, you can keep these from bleeding into each other by using distinct email addresses for each. If you want one identity to stay disconnected from another, don't reuse the same email across them.

What "public" means in practice

Gravatar is used by WordPress, GitHub, Slack, OpenAI, Atlassian, Figma, Mailchimp, Stack Overflow, Coinbase, and thousands of other platforms. When your profile is public, those integrations can surface your avatar and profile details. So the decision to publish is effectively a decision to be recognizable across many sites at once.

If you'd rather not be recognizable, the private option and the multiple-identity setup are the two levers to use. If you do want a consistent presence — a link-in-bio style page, a digital business card — then a public profile is the point.

A quick way to think about it

Ask two questions before you publish:

1. Do I want this identity recognized across sites? If yes, make it public. If no, keep it private or use a separate anonymous email.
2. Which email does this identity belong to? Keep work, personal, and anonymous on separate addresses so they stay separate.

Gravatar gives you the controls — private profiles, selective sharing, and multiple identities. What it can't do is un-share something you've chosen to make public, so the configuration step is where your privacy is actually decided.

A free hosted REST API like ReqRes gives you a real HTTP endpoint you can call immediately—no signup, no local server, no database setup. You get predictable JSON responses for users, resources, login, and registration, which makes it useful for front-end demos, integration tests, learning HTTP clients, and prototyping. What it is not is a production backend for your app: the data is shared, resets periodically, and you don't control the schema. If you need persistent, private data with auth and logs, that's where an account-based backend or a commercial licence comes in.

What "free REST API for testing and prototyping" actually means

The phrase sounds vague, so it helps to separate two things people often conflate:

• A mock/sample API — a public, hosted service with fixed or semi-fixed endpoints that return realistic-looking JSON. You don't own the data. It exists so you can point code at a URL and get a response.
• A real backend you configure — a service where you define collections, schemas, authentication, and logging, and where your data persists and belongs to you.

ReqRes's landing page describes both: a free REST API for testing and prototyping with real responses and no signup, plus an option to build your own backend with collections, auth, and logs at app.reqres.in. Those are different products with different trade-offs. The free public endpoints are the "point and go" part; the account-based backend is the "own your data" part.

What you can do with the no-signup public endpoints

1. Front-end demos without a backend

If you're building a UI and need data to render, you can fetch from a public endpoint instead of hardcoding arrays. This keeps your demo code closer to real fetch logic:

async function loadUsers(page = 1) {
  const res = await fetch(`https://reqres.in/api/users?page=${page}`);
  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  const { data, total, page: current } = await res.json();
  return { users: data, total, page: current };
}

You get pagination fields, a data array, and support metadata—enough to build list views, loading states, and empty states.

2. Integration and contract tests

You can assert that your HTTP layer handles status codes, headers, and JSON shapes correctly. Typical checks:

• GET /api/users/2 returns 200 with a data object.
• GET /api/users/23 returns 404 (a non-existent user).
• POST /api/login with valid credentials returns a token; with missing fields returns 400.

This is useful for testing your client wrapper, retry logic, error handling, and serialization—without spinning up your own server.

3. Learning HTTP clients and tooling

If you're new to fetch, Axios, curl, Postman, or HTTPie, a hosted API is a low-friction target. You can practice:

• Sending query parameters (?page=2, ?delay=3).
• Setting headers and reading response headers.
• Handling POST, PUT, PATCH, DELETE.
• Observing status codes for success and failure.

4. Deliberate failure and latency testing

Endpoints that return 404 on purpose, or that accept a delay parameter, let you test how your app behaves when things go wrong or slow down. That's hard to do reliably against a happy-path local mock.

What the public endpoints are not good for

The key limitation: you don't own the data, and other people are hitting the same endpoints. Treat responses as illustrative, not authoritative.

When you'd move to an account-based backend

Consider app.reqres.in (collections, auth, logs) when any of these are true:

• You need your own collections and fields, not the fixed demo schema.
• You need data to persist between sessions and belong only to you.
• You need real authentication flows you can rely on in a demo or internal tool.
• You need request logs to debug what your client actually sent.
• You're working with a team and need shared, stable endpoints.

The trade-off is setup and, eventually, cost. The public endpoints require none; the backend requires an account and configuration.

Where pricing and licensing become relevant

The site signals a commercial licence and an upgrade path (with Stripe as the payment platform), but specific prices, plan tiers, and limits aren't stated here—so don't assume numbers. What you can reason about:

• Prototyping and learning → free public endpoints are usually enough.
• Internal tools, demos for clients, or anything you don't want reset → an account-based backend is the natural next step.
• Production or commercial use → check the licence terms and any paid plan, because "free for testing" and "free for commercial production" are not the same thing.

Before committing, read the current terms on the site rather than relying on secondhand summaries, since pricing and licence scope change.

A quick decision checklist

1. Do you need data that persists and is private? If yes → account-based backend.
2. Do you need a custom schema? If yes → account-based backend.
3. Are you only testing HTTP behavior, UI rendering, or learning a client? If yes → free public endpoints.
4. Will this touch real users or revenue? If yes → review the licence and any paid plan first.
5. Do you need logs and team access? If yes → account-based backend.

If you answer "no" to 1, 2, 4, and 5, the free hosted API is likely all you need. If you answer "yes" to any of them, plan for the account-based path.

OpenAPI-generated API documentation is reference documentation that is produced automatically from an OpenAPI description file rather than written by hand. You write (or generate) a machine-readable specification of your API — endpoints, parameters, request bodies, responses, schemas, and auth — and a documentation tool reads that file and renders a browsable, often interactive reference site. The spec becomes the single source of truth; the docs become a build artifact.

This differs from manually written docs in one fundamental way: with hand-written docs, the prose is the source of truth and the API is described separately. With spec-driven docs, the API description is the source, and every page, table, and code sample is derived from it.

How the workflow actually runs

A typical spec-driven documentation pipeline has five stages:

1. Author or generate the spec. You either write an OpenAPI document by hand (YAML or JSON), or generate it from code annotations, framework metadata, or a design-first editor. Design-first means the spec is written before implementation; code-first means it is extracted from existing code.
2. Validate and lint. The spec is checked against the OpenAPI schema and against style rules — consistent naming, required descriptions, no undocumented 4xx responses, no orphaned schemas.
3. Bundle and transform. Multi-file specs are combined, $ref pointers are resolved, and the document is optionally split into per-tag or per-version outputs.
4. Render. A documentation tool converts the spec into HTML: an endpoint list, a sidebar of operations, parameter tables, response schemas, and a "try it" console.
5. Publish and version. The rendered site is deployed, and each API version gets its own snapshot so consumers can read docs matching the version they call.

Steps 2 through 5 are usually automated in CI. If the spec fails validation, the docs build fails — which is the point.

Spec-driven vs. hand-written documentation

The practical conclusion most teams reach: generate the reference, write the guides. Reference material is repetitive and mechanical, which is exactly what generation is good at. Conceptual explanations, migration notes, and tutorials carry judgment that a spec cannot express.

What you get out of the box

Generated reference pages commonly include:

• An operation list grouped by tag or path, with HTTP method and path.
• Parameter tables showing name, location (path, query, header, cookie), type, required flag, and description.
• Request and response schemas rendered as expandable trees, including nested objects and arrays.
• Authentication details pulled from the securitySchemes section.
• Interactive request consoles that let a reader send a real call from the browser.
• Generated code samples in several languages, derived from the same schemas.
• Multiple output formats, such as a static site, a single HTML file, or a mock server.

Because all of these come from one document, changing a field name in the spec updates the parameter table, the schema tree, and every code sample at once.

Where spec-driven documentation breaks down

Generation is not free. The trade-offs are real:

Spec quality becomes documentation quality. A field with no description produces a table row with an empty cell. A vague summary produces a vague heading. Tools can enforce presence of descriptions via linting, but they cannot enforce that the description is useful.

Customization has limits. If you need a page that does not map to an OpenAPI concept — a conceptual overview, a pricing explanation, a comparison of two endpoints — you write it outside the generator and link to it.

Not everything is expressible. Webhooks, streaming responses, long-polling behavior, and complex multi-step flows are awkward or impossible to describe fully in OpenAPI. Those need prose.

The spec can go stale. If the spec is maintained separately from the implementation, it drifts just like hand-written docs. The mitigation is to generate the spec from code, or to test the implementation against the spec in CI.

Interactive consoles need care. A "try it" button that hits a production API with real credentials is a security and rate-limit problem. Point it at a sandbox, or disable it.

Deciding whether to adopt it

Adopt spec-driven reference documentation if most of these are true:

• Your API has more than a handful of endpoints, or changes frequently.
• You ship client SDKs or code samples in more than one language.
• Multiple teams consume the API and need a consistent, always-current reference.
• You already have, or are willing to maintain, an OpenAPI description.

Stay with hand-written docs, or a hybrid, if:

• Your API is small and stable, and the reference fits on one page.
• Your documentation is mostly conceptual and contains little endpoint-level detail.
• You cannot commit to keeping the spec in sync with the implementation.

A reasonable middle path: generate the reference from the spec, and hand-write the getting-started guide, authentication walkthrough, and error-handling page. Link the two directions so readers can move from concept to endpoint and back.

A minimal starting checklist

1. Produce one valid OpenAPI document for a single API version.
2. Add a linter with rules for descriptions, operation IDs, and error responses.
3. Wire the docs build into CI so a failing spec fails the build.
4. Render the reference and review it as a reader, not as the author.
5. Write the two or three conceptual pages the generator cannot produce.
6. Version the published docs alongside the API version.

The core idea is simple: describe the API once, in a format both machines and humans can read, and let the reference documentation fall out of that description. Everything else — tooling, hosting, interactivity — is a detail on top of that decision.

Gravatar is used by WordPress, GitHub, Slack, OpenAI, Atlassian, Figma, Mailchimp, Stack Overflow, and Coinbase, among thousands of other platforms. If you use the same email address across these services, each one can pull your Gravatar avatar and profile automatically — so you upload and update your image in one place instead of on every site. This is worth setting up if you want a consistent identity across tools you already use, and less useful if you only care about a single platform.

Platforms That Display Gravatar

Gravatar's own site lists the following services as users of its avatars and profiles:

The key point is that these are not integrations you configure yourself. Gravatar works by matching the email address you registered with on each platform to the profile tied to that same address on Gravatar.

How the Matching Actually Works

Gravatar links your identity to an email address, not to your name. When a platform supports Gravatar, it takes the email address on your account, hashes it, and requests the corresponding image from Gravatar's servers.

The hashing is visible in Gravatar's own developer examples. In JavaScript:

const sha256 = require('js-sha256');

function getGravatarURL(email) {
  const address = String(email).trim().toLowerCase();
  const hash = sha256(address);
  return `https://gravatar.com/avatar/${hash}`;
}

In PHP:

function get_gravatar_url($email) {
  $address = strtolower(trim($email));
  $hash = hash('sha256', $address);
  return 'https://gravatar.com/avatar/' . $hash;
}

Two details matter for whether your avatar shows up:

• The email must match exactly. Both examples trim whitespace and lowercase the address before hashing, so casing and stray spaces are normalized — but a different address (work vs. personal) produces a different hash and therefore a different avatar.
• The platform must actually request the image. Being on the list above means the service supports Gravatar; it does not guarantee every surface within that product displays it.

What Syncs When You Update

Gravatar's stated behavior is "update once, sync everywhere." When you change your avatar or profile, the changes appear across the platforms that pull from Gravatar, rather than requiring a separate upload on each one. Your profile can also carry social links, a portfolio, a website, and other links, functioning like a digital business card or link-in-bio page.

Because Gravatar ties identity to an email address, you can manage separate work, personal, and anonymous profiles under different addresses.

Privacy Controls

Gravatar states that you control what is shared: you can make your profile private or choose what you share and when. If you are deciding whether to set one up, the practical question is which email address you use on the platforms above — that address is what determines which profile those services can surface.

When Gravatar Is Worth Setting Up

• Worth it if you use several of the listed platforms with the same email and want one avatar to follow you across them.
• Worth it if you want a single link-in-bio page tied to that identity.
• Less useful if you only use one platform, since you can set an avatar directly there.
• Check first if you use different email addresses per service — you would need a Gravatar profile for each address to get consistent results.

Gravatar links an avatar to an email address by hashing that address and serving the image at a URL built from the hash. Any site that knows a visitor's email can compute the same hash and request the matching image, so one avatar follows you across every platform that has adopted the system. The binding is to the email, not your name, which is why the same person can run separate work, personal, and anonymous profiles.

The core mechanism: email in, hash out

The process has three steps:

1. Normalize the email. Trim leading and trailing whitespace and convert all characters to lowercase.
2. Hash the result. Apply SHA256 to the normalized string.
3. Build the URL. Append the hash to https://gravatar.com/avatar/.

The result is a plain image URL. No API key, no login, and no per-site upload is involved on the requesting side — the site only needs the email address it already has.

Gravatar's own developer examples show this directly. In JavaScript:

const sha256 = require( 'js-sha256' );

function getGravatarURL( email ) {
  const address = String( email ).trim().toLowerCase();
  const hash = sha256( address );
  return `https://gravatar.com/avatar/${ hash }`;
}

And in PHP:

function get_gravatar_url( $email ) {
  $address = strtolower( trim( $email ) );
  $hash = hash( 'sha256', $address );
  return 'https://gravatar.com/avatar/' . $hash;
}

Both snippets do the same thing: the email is the input, the hash is the identifier, and the returned URL is what an <img> tag points at.

Why the hash matters

Because the identifier is a hash of the email rather than the email itself, a site can display your avatar without storing your raw address in the image URL. The same email always produces the same hash, so every platform that implements the lookup independently arrives at the same image.

What happens when you update

Gravatar's pitch is "Update Once, Sync Everywhere." When you change your avatar or profile, the change appears across the platforms that pull from Gravatar. The mechanism is straightforward: those sites don't host a copy tied to your account — they request the image from the hash-based URL at load time. Change what that URL returns, and every requesting page shows the new version.

This is the practical difference between Gravatar and uploading a photo to each site separately. You maintain one profile; the sites do the lookup.

What the profile contains beyond the image

The avatar is only part of it. A Gravatar profile works like a digital business card and can include:

• A bio
• Social media profiles
• A portfolio or personal website
• Other verified links

That makes it usable as a link-in-bio page as well as an avatar source. Gravatar describes the profile as turning your email address into a "digital passport" — one avatar, one bio, social connections, and verified links.

Managing multiple identities

Because identity is tied to an email address rather than a name, you can run several profiles side by side. A work address, a personal address, and an anonymous address each hash to a different avatar and profile. Sites requesting the work address get the professional version; sites requesting the personal one get something else. You don't have to choose a single public identity.

Privacy controls

Gravatar states that you control what you share: you can make your profile private or choose what to share and when. The design intent is that your data stays yours. If you're deciding whether to use it, the relevant question is which email addresses you're willing to associate with a public profile, since the lookup works from the address itself.

For developers integrating it

Gravatar offers a REST API, SDKs, and tutorials for adding profiles to an application. The use case it names is bootstrapping a community with verified user profiles — avatars, social links, and more — without building that infrastructure yourself. The two snippets above are the minimal integration; the API extends it to profile data beyond the image.

Gravatar lists WordPress, GitHub, Slack, OpenAI, Atlassian, Figma, Mailchimp, Stack Overflow, and Coinbase among the platforms using it, which is why a single profile tends to appear in many places at once.

When this model fits — and when it doesn't

Gravatar is a good fit if you want one avatar and bio to follow an email address across many sites, or if you're building a product and want user avatars without hosting them. It's a weaker fit if you need per-site customization that differs from your global profile, or if you'd rather not associate a given email address with a discoverable public profile. The email is the key, so the choice of which address you use is the real decision.