First let’s look at the shapes that make up each “patch” of an identicon. There are sixteen distinct shapes. Two of them (the first and fifth) are unchanged by rotation. The others can be in any of four orientations (they can be rotated by multiples of 90 degrees.) Actually, one of the shapes only really has two positions; rotated 180 degrees is the same as unrotated. (Which one is it?)
For comparison, here are Don Park’s original fifteen shapes:
Lastly, here are the 44 shapes that the wp_identicon PHP code (used, eg, by Gravatar) defined:
The following images are identicons based on parts of the SHA256 hash of a name or email address. I’ve put the 3x3 right before the 5x5 so it’s easy to compare them. As you can see, they are related: the 3x3 is embedded in the 5x5. But this is not required; I did it this way to put the 5x5 in context.
There are two versions of the 4x4. The first uses the same shape for each of the two slots along the side, but rotates it (clockwise 90 degrees) as you go clockwise around the figure. The second 4x4 uses two distinct shapes for the two slots. I wanted to compare how they look.