Hasher-Matcher-Actioner

license

BSD-3-Clause(OSI, the ThreatExchange repository license, which covers HMA)

source

public(the whole service builds from facebook/ThreatExchange/hasher-matcher-actioner)

self-host

yes(Docker image or Python library)

service

none

core features withheld

no

HMA is released under the BSD license that covers Meta's whole ThreatExchange repository, and the complete service builds from that published code and runs on your own servers. Meta launched it as a free tool, none of its documentation mentions a paid or hosted edition, and the 2.0 rewrite replaced its AWS dependencies with open-source components only.

• https://about.fb.com/news/2022/12/meta-launches-new-content-moderation-tool/ recorded 2026-10-13

  Meta's newsroom post of December 13, 2022, by Nick Clegg, says Meta is "making available a free open source software tool it has developed that will help platforms identify copies of images or videos and take action against them en masse", called Hasher-Matcher-Actioner, and that it will be "especially useful for smaller companies who don’t have the same resources as bigger ones".

• https://cdn.jsdelivr.net/gh/facebook/ThreatExchange@main/hasher-matcher-actioner/pyproject.toml recorded 2026-10-13

  The HMA package metadata names the project "OpenMediaMatch", lists "Meta Platforms, Inc. and affiliates" as author, and carries the classifier "License :: OSI Approved :: BSD License". Its dependencies are open-source Python packages such as flask, psycopg2 and threatexchange.

• https://cdn.jsdelivr.net/gh/facebook/ThreatExchange@main/hasher-matcher-actioner/README.md recorded 2026-10-13

  The HMA README calls it "a reference implementation for a key Trust and Safety content moderation capability: copy detection", says "HMA can be used as a library, or in any deployment setup that can use docker", and runs it from the published image "ghcr.io/facebook/threatexchange/hma" or locally with "docker compose up" in the hasher-matcher-actioner directory. Searched the body for enterprise, pricing, commercial, paid and license key: none.

• https://cdn.jsdelivr.net/gh/facebook/ThreatExchange@main/LICENSE recorded 2026-10-13

  The LICENSE file at the root of facebook/ThreatExchange opens "BSD License" and "For ThreatExchange software", with "Copyright (c) Meta Platforms, Inc. and affiliates.", and carries the three BSD clauses: keep the copyright notice in source, reproduce it in binary distributions, and "Neither the name Facebook nor the names of its contributors may be used to endorse or promote products".

• https://cdn.jsdelivr.net/gh/facebook/ThreatExchange@main/README.md recorded 2026-10-13

  The repository README says "All projects in this repository are under the BSD license", with exceptions only for files "included for demonstration purposes", and lists one: "pdq/cpp/CImg.h". It lists HMA among the sub-projects alongside PDQ, TMK, vPDQ and python-threatexchange. Its HMA paragraph still describes the older AWS deployment.

• https://cdn.jsdelivr.net/gh/facebook/ThreatExchange@main/website/content/hma/history.md recorded 2026-10-13

  The project history says that in March 2024 the team archived the original version and replaced it with a full rewrite, proposing "a new, entirely open source offering of composable components". Its comparison table lists HMA 2.0 as "OSS dependencies only" and "Runs in any Docker based infra", against HMA 1.0's "Heavy AWS dependencies". Searched the body for enterprise, pricing, paid and license key: none.

HMA ships as a container image on GitHub's registry rather than as a package with a public download count, and its repository is shared with other projects, so neither gives a usage figure for HMA itself. The clearest sign of use is that ROOST's open-source moderation console, Coop, runs HMA as its hash-matching service. Meta has not published how many platforms deploy it.

• https://about.fb.com/news/2022/12/meta-launches-new-content-moderation-tool/ recorded 2026-10-13

  Meta's December 2022 launch post says Meta hopes HMA "will be adopted by a range of companies" to stop the spread of terrorist content, and gives no adopter names or deployment count.

• https://cdn.jsdelivr.net/gh/facebook/ThreatExchange@main/website/content/hma/releasing.md recorded 2026-10-13

  The HMA release guide says that on each release "Docker images are built and pushed to GHCR", tagged latest and with the version number, and tests the image with "docker pull ghcr.io/facebook/threatexchange/hma:1.1.3". It publishes no pull or install count.

• https://cdn.jsdelivr.net/gh/roostorg/coop@main/package.json recorded 2026-10-13

  The root package.json of the Coop repository defines an "up" script that runs "docker compose up --detach postgres clickhouse hma scylla redis otel-collector", starting HMA as one of the services in Coop's local stack.

• https://roost.tools/coop/ recorded 2026-10-13

  ROOST's Coop page says Coop's child safety workflow "goes further with hash matching via HMA, NCMEC CyberTipline reporting, and integrations with Google Content Safety API and OpenAI Moderation API". It gives no count of HMA deployments.

HMA covers one stage of a moderation pipeline in depth: recognizing copies of images and videos a platform or an industry hash list has already flagged, with the exchange connections that make those lists usable. Coop covers more of the workflow, with review queues, routing and reporting, and relies on HMA for its own hash matching, so the two sit level. HMA dropped the rules for acting on a match when it was rewritten, and it handles only exact and near-duplicate media, not new content.

• https://cdn.jsdelivr.net/gh/facebook/ThreatExchange@main/hasher-matcher-actioner/README.md recorded 2026-10-13

  The README describes the process by which "new content is evaluated against collections of known content (called "Banks" in HMA)": content is hashed, matched "against an index of known content", and acted on if it matches. It names the NCMEC Hash Sharing Program, GIFCT's Hash-Sharing Database, StopNCII.org and Meta's ThreatExchange, says custom algorithms plug in through python-threatexchange interfaces, and says HMA "is designed with horizontal scalability in mind".

• https://cdn.jsdelivr.net/gh/facebook/ThreatExchange@main/website/content/hma/architecture.md recorded 2026-10-13

  The architecture page splits a scaled deployment into Hashers, which turn images into PDQ hashes, Matchers, which "periodically rebuild their (in-memory) FAISS indices", and Curators, which import hash lists and edit bank content. It says the API and CLI are built into the Python package and the API service is distributed as a Docker image.

• https://cdn.jsdelivr.net/gh/facebook/ThreatExchange@main/website/content/hma/goals.md recorded 2026-10-13

  The goals page lists "Image + PDQ" and "Video + MD5" as fully implemented, a single-box target to "fetch, store, index at least 10M PDQ hashes", and a multi-instance target where "1000 qps image hash + match should be possible". Under non-goals it says the actioning interface from HMA 1.0 is on hold for 2.0 and that vPDQ video lookup is not implemented.

• https://cdn.jsdelivr.net/gh/facebook/ThreatExchange@main/website/content/hma/user-interface.md recorded 2026-10-13

  The user-interface guide says HMA "includes a web app where users can configure their signal banks, connect to exchanges like NCMEC, StopNCII, GIFCT, ThreatExchange, and others, and debug matches", across four pages starting with a dashboard showing system status and index statistics.