FORENSIAWeb3 forensicsOpen workspace

Recognising what you pasted

How Forensia tells a Bitcoin address from an Ethereum one, and an address from a transaction, before it contacts any source.

2 min read · How a lookup works

#Plain languageIn plain terms

You paste one string into the search box. It might be a wallet address, a contract, or a transaction, on Bitcoin or on one of several Ethereum-style networks. Forensia works out which from the shape of the text alone, so it knows which sources to ask.

If the text does not look like any supported identifier, no source is contacted and you are told what is accepted.

#How it worksHow it works

  1. Trim the text and check its length. Anything over 80 characters is refused.
  2. Test it against the known shapes, in a fixed order.
  3. Decide the family: Bitcoin or EVM (Ethereum-style).
  4. Decide the kind: address or transaction.
  5. Normalise it so the same identifier always reads the same way.

#Technical detailThe exact rules

ShapeRead as
0x followed by 40 hex charactersEVM address
0x followed by 64 hex charactersEVM transaction hash
Starts with 1 or 3, 26 to 35 base58 charactersBitcoin address (legacy)
Starts with bc1, 14 to 74 charactersBitcoin address (SegWit or Taproot)
64 hex characters with no 0xBitcoin transaction ID

The 0x prefix is what separates an Ethereum transaction hash from a Bitcoin transaction ID. Both are 64 hex characters.

EVM addresses are then checked strictly. An all-lowercase address is accepted. An address with mixed case must match its EIP-55 checksum, where the pattern of upper and lower case letters encodes a check on the address itself. A mixed-case address that fails is rejected. Accepted addresses are stored in checksummed form and transaction hashes in lower case.

The request itself is bounded too: the body is capped at 4,096 bytes, must be JSON, and cross-site requests are refused.

#LimitsWhat it does not tell you

  • Bitcoin addresses are checked by shape only. Their built-in checksum is not verified, so a mistyped address can pass this step and then simply return nothing.
  • Only Bitcoin mainnet is recognised. Testnet addresses are refused.
  • An EVM address does not say which network it belongs to. That is settled by the next step, network resolution.
  • Recognising an identifier says nothing about whether it has ever been used.