Tools · Files

IS THIS FILE KNOWN MALWARE?

The file hash is computed in your browser and only 64 characters leave. A hit means confirmed malware; without one, we say what to weigh before you open it.

Pick a file you do not trust. The browser computes a SHA-256 hash of it — a short string that identifies the file uniquely but from which its contents cannot be reassembled. Only that hash goes to the server, and we use it to query databases of known malware.

The file stays with you. It is not uploaded to us or anywhere else; the whole computation runs in the browser and 64 hex characters go out. The rest of the page traffic behaves as it does everywhere else on the web — we host the font ourselves and, once cookies are accepted, we send our own traffic measurement. The details are in the privacy policy.

What a hash check can and cannot tell The tool queries databases of confirmed malware, so it answers one specific question: is exactly this file listed somewhere as malicious? A hit is a certainty — somebody has already caught this file and taken it apart. Without a hit you have a good opening signal and a few points to weigh before you open the file. A database knows what has already been analysed, so a brand new sample or an attack aimed at a single company may not be in it yet; changing a single byte is enough to make the hash different. This replaces neither antivirus nor EDR — those look at how a file behaves, this looks only at its hash.

Drag a file here or choose one. It stays on your device.

The file is not sent anywhere — the browser reads it in chunks, computes the hash and sends only that. A larger file takes a while; you can watch the progress and stop it at any point.

Useful when the hash arrived in an EDR alert or from IT — and also for files too large to hash in the browser. Only SHA-256 is accepted, that is 64 characters. The tool takes neither MD5 nor SHA-1; shorter hashes can be forged these days.

What to do now

  • Do not open the file and do not run it. Do not forward it to colleagues either, not even "to show them" — an attachment that circles the company infects more people than the original email did.
  • Disconnect the device from the network if you have already run the file. You do not have to switch it off; disconnecting stops further communication, switching off throws away the traces held in memory.
  • Do not delete the file and do not delete the original email either. They are both evidence and the starting point of the investigation; without them there is no way to establish what exactly happened and whether the attack continues by another route.
  • Tell IT or the security team and hand them the hash from this output. With it they can find out whether the same file has turned up elsewhere in the company.
  • Run the file past the corporate antivirus or EDR. Unlike this check, those also see behaviour and context, not just a matching hash.
  • Change the passwords you used on that device, and do it from a different computer. Stealing credentials is the most common first step.

Before you open the file

  • Who it is from. Do you know the sender, and does the address the message came from match? For anything of value, verify the sender through another channel — call a number you already know, not the one in the email signature.
  • What type it is. An executable, an installer, a script or a password-protected archive deserves more caution than an image or a PDF. Watch out for double extensions and for a document that asks you to enable macros or "enable content" once opened — there is no legitimate reason for that.
  • Whether you expected it. An invoice you never ordered, or an update you never asked for, is suspicious in itself — regardless of what the hash check showed.
  • Where you got it from. Download software from the vendor's site, not from a link in a message and not from the first search result. Paid links above the results are often spoofed.
  • What the corporate tools say. Run the file past antivirus or EDR; for anything sensitive, wait for IT to weigh in. Those look at how the file behaves, this check only at its hash.
  • If you are still not sure after these points, do not open the file. The price of an unopened file is one phone call; the price of an opened one tends to be a good deal higher.

How it works

WHAT LEAVES YOUR DEVICE

A SHA-256 hash is an open one-way function: it turns a file into 64 characters, but those 64 characters cannot be turned back into the contents of the file. That is why it can be sent to places you would never send the file itself.

01

The file stays with you

The browser reads it in blocks straight from the disk. It is not uploaded anywhere and is never held in memory as a whole, so even a large file can be processed.

02

The hash is created in the browser

SHA-256 is computed progressively from the individual blocks. The correctness of the computation is verified against known test values when the page loads.

03

64 characters go out

Only the hash goes to our server. From there it is sent to the databases of known malware — your IP address never reaches them, because we do the asking, not your browser.

04

The answer is binary

A database either knows such a sample or it does not. You get no score and no probability — which is why the answer is a pointer, and we add to it what else to weigh about the file.

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

goes to the server (64 hash characters) stays with you (the whole file)

The example is the hash of an empty file — a constant from public examples, not your file. A hash can be compared against a list of known samples, but it cannot be turned back into the contents of a file.

The query to the database is sent by our server, not by your browser. The database operator therefore sees only our server and the hash — not who was asking. The hash is cached with us for a few hours so that a repeated query does not needlessly load a third-party service; we store nothing else about the check.

You can compute the hash yourself

This is useful for large files and anywhere you would rather not let a file near the browser. The result is the same string — paste it into the second field of the form.

Upper and lower case in the hash make no difference, the tool normalises them itself.

What the check does not do

More tools

WHAT YOU CAN CHECK RIGHT AWAY

Password breach check Is your password in lists from public breaches? The hash is computed in the browser and only its beginning leaves. Password and passphrase generator A new password or passphrase with the entropy shown. Created in the browser, sent nowhere. Website security headers What your site tells browsers about its security — CSP, HSTS, cookies and more.
Content valid as of 8 August 2026

When it gets more serious

One file is a hit.
The question is how it reached you.

A hash check answers one thing, and only at one moment in time. Whether anyone else received the same attachment, which way the route inside led and what happened afterwards is something only a review of the environment will show. We can help with that.

Write to us →