Malware hash lookup
Paste a file hash (MD5, SHA-1, SHA-256 or SHA-512) and we check it against our malware corpus, built from public threat-sharing feeds, and link you straight to independent lookup services. Know whether a file is known malware before you run it, without uploading it.
Checking the fingerprint against the malware corpus…
What a file hash is
A hash is a short fingerprint calculated from every byte of a file. The same file always gives the same hash, and changing a single byte gives a completely different one. That makes a hash a safe way to ask "is this file known malware?" without sending the file anywhere: the hash reveals nothing about what the file contains.
How to get a file's hash
Windows (PowerShell)
Get-FileHash .\invoice.exe -Algorithm SHA256Or in a Command Prompt: certutil -hashfile invoice.exe SHA256.
macOS
shasum -a 256 invoice.pdfLinux
sha256sum invoice.pdfCopy the long string of letters and digits the command prints and paste it above. SHA-256 is the best choice; MD5 and SHA-1 work too, because many older reports only list those.
Reading the result
A match means the exact file has been reported as malicious: you see the malware family, the file type and when it was first seen, with links to look the same hash up in independent services. No match means this exact file is not in the corpus. Malware is often rebuilt so that every copy has a new hash, so if you still have the file, the free malware scan goes further by checking its content against signatures and rules.
Common questions
Which hash types can I look up?
MD5, SHA-1, SHA-256 and SHA-512. The type is recognised from the length, so just paste the hash.
Is the malware hash lookup free?
Yes, with no account, for 5 lookups a day.
Can I check hashes in bulk?
For volume or automation, our Threat Intelligence service answers file fingerprints through an API.
Stop known-bad binaries at the source
Our endpoint agent fingerprints every executable and blocks the ones our intelligence flags, across your whole fleet, automatically.