Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash, or drop a file to hash it locally, then check it against live malware feeds.
This hash checker answers two questions fast: what kind of hash is this, and is it known to be malicious? Paste an MD5, SHA-1, or SHA-256 value and the tool identifies the algorithm, then checks the hash against live threat-intelligence feeds and known-good software databases. You can also drag a file straight onto the page — it is hashed locally in your browser, and only the resulting digest is ever sent anywhere. The file itself never leaves your device.
It is the tool to reach for when an alert, a threat report, or a colleague hands you a bare hash string and you need to know whether it matters. Analysts use it for triage, IT teams use it to check a download against a vendor’s published checksum, and incident responders use it to confirm whether an artefact is a known sample or something new.
Hash type is inferred from length, which is unambiguous for the algorithms that matter in malware intelligence. Paste anything and the detector tells you what you have:
| Algorithm | Hex characters | Bits | Status |
|---|---|---|---|
| MD5 | 32 | 128 | Cryptographically broken — usable as a checksum, unsafe for security |
| SHA-1 | 40 | 160 | Deprecated — practical collision attacks exist |
| SHA-256 | 64 | 256 | Current standard for integrity and signatures |
The detector also handles the near misses. A 128-character value is recognised as SHA-512, and the tool explains that malware databases index MD5, SHA-1, and SHA-256 — so your report almost certainly lists one of those alongside it. Any other length of hex triggers a “this is not a complete hash” warning with the character count, which catches the single most common mistake in this workflow: a truncated copy-paste.
Note the deliberate limitation. This is a file-hash and malware-hash tool, so it identifies file-hash algorithms. It does not attempt to classify password hash formats such as bcrypt, NTLM variants beyond the raw 32-character form, or salted database hashes.
A hash search here runs through a chain of sources, cheapest and most authoritative first, stopping as soon as a settled verdict is reached:
Results show a status (malicious, known-good, or no match), a threat level, a malware family name where one is known, and a first-seen date, along with reference links back to the source record so you can read the original report.
One thing to understand about “no match”: it is not a clean bill of health. It means the hash is not in any of these datasets. A file compiled ten minutes ago will not be in them either. Absence of a hit is evidence of novelty, not of safety.
Drop a file onto the upload area and it is hashed in your browser using the Web Crypto API. SHA-256 is the default and SHA-1 is offered as an alternative for matching older references. MD5 is deliberately absent from file hashing because the browser’s native crypto implementation does not provide it — if you need to compare against a published MD5, hash the file with your operating system’s own tools and paste the result into the lookup box.
Command-line equivalents for producing the same digest locally:
sha256sum file.bin or shasum -a 256 file.binmd5 file.binGet-FileHash file.bin -Algorithm SHA256certutil -hashfile file.bin SHA256Because hashing runs on the raw bytes, the digest must match character-for-character. If a download’s hash does not match the vendor’s published value, the file is different — corrupted in transit, a different build or version, or tampered with. There is no such thing as a “close enough” hash.
A hash lookup can only recognise what has already been seen. For files that return no match, an optional deep scan runs additional analysis entirely in your browser, in a background worker, on bytes that never leave your device:
This is static analysis. It does not execute anything, and it is not a substitute for a sandbox or an endpoint agent — it is a fast first opinion on a file you were about to be suspicious of anyway. For deliberately obscured scripts, the malware deobfuscator and the entropy analyzer go further.
Threat reports rarely contain one hash. Paste a list — one hash per line — into the batch mode and the whole set is checked together, with a summary showing the total submitted alongside how many came back malicious, known-good, or unmatched. Mixed algorithms in the same list are fine; each line is detected independently. This is the practical way to work through the indicator table at the bottom of a vendor writeup without opening a browser tab per row.
A hash is a fixed-length fingerprint computed from a file’s bytes. Change a single bit anywhere in the file and the hash changes completely. That property makes hashes ideal for verifying that a download is byte-identical to what the publisher released, and for referring to a malware sample without sharing the sample itself.
Yes, for file hashes. Length identifies MD5 (32 characters), SHA-1 (40), and SHA-256 (64) unambiguously, and SHA-512 (128) is recognised and explained. Anything else is reported as an invalid or truncated hash rather than guessed at.
No, and neither can anything else. Hashing is one-way. What a lookup service does is match your hash against hashes it has already computed from files it has seen — recognition, not reversal.
No. The file is read and hashed in your browser using the Web Crypto API, and only the resulting hash string is sent for the reputation lookup. Deep scan analysis also runs locally on the file bytes. The file itself never leaves your device.
Not necessarily. No match means the hash is not present in the threat feeds or known-good databases consulted. Brand-new malware is unknown by definition. Treat an unmatched hash on a suspicious file as a reason to investigate further, not as an all-clear.
Browsers’ native Web Crypto API supports SHA-1 and SHA-256 but not MD5, so file hashing offers those two. You can still paste an MD5 hash produced elsewhere into the lookup box — MD5 is fully supported for lookups.
The file is not the same file. The usual causes are an interrupted or corrupted download, a different version or build than the one the checksum was published for, or a mirror serving modified content. Re-download from the official source and compare again before running it.
No. The hash checker is free and needs no signup. Like the rest of our security tools, it works straight from the browser. If you need to generate hashes of text rather than look them up, use the hash generator; to identify a file type from its magic bytes, use the file magic number checker.
This tool answers two questions fast: what is this file's hash, and is that hash known malware?
A cryptographic hash is a fixed-length fingerprint of a file. Change one bit and the hash changes completely, so a hash is a reliable file identifier. Checking that fingerprint against malware databases lets you classify a file as known malicious without ever executing it — the core of malware triage and incident response.
| Algorithm | Length | In-browser file hashing | Notes |
|---|---|---|---|
| MD5 | 32 hex chars | Not available | Legacy; still common in older malware feeds. Paste-lookup supported. |
| SHA-1 | 40 hex chars | Yes | Deprecated for signing, still used as a file identifier. |
| SHA-256 | 64 hex chars | Yes (recommended) | Current standard; what most threat feeds key on. |
Why no in-browser MD5? The Web Crypto API (
crypto.subtle.digest) deliberately omits MD5. For file hashing we use SHA-256 or SHA-1; you can still paste an MD5 hash to look it up.
Hash lookup finds exact matches only. A "clean" / "not found" result means the hash is not in our local known-malware list — it does not prove the file is safe. Zero-day, polymorphic, and packed malware change their hash with every build and will not match. Always confirm uncertain files on VirusTotal/MalwareBazaar, and use behavioral analysis for anything suspicious.
File hashing and hash detection run 100% client-side. Files are read into memory in your browser, hashed with Web Crypto, and discarded — they are never uploaded. Hash lookups are matched locally; only when you click an external link does a hash leave the page, and only to the reputation service you chose.
Open the File Hash Check tab and drag a file in (or click to browse). The file is hashed entirely in your browser with the Web Crypto API — SHA-256 by default, or SHA-1 — and the resulting hash is automatically looked up against known malware. The file itself is never uploaded.
Yes. Hashing uses the browser's built-in Web Crypto API (crypto.subtle.digest). The file is read into memory locally, hashed, and discarded. Its bytes are never sent to our servers and nothing is logged. You can verify this in your browser's network tab — there is no upload request.
Paste a hash (MD5, SHA-1, or SHA-256) or hash a file, and the tool checks it against a curated known-malware list and shows a clear verdict. For an authoritative answer, click the VirusTotal or MalwareBazaar (abuse.ch) link on the result to see detections from 70+ antivirus engines and a live malware corpus.
Yes. Use the Batch Lookup tab to paste up to 100 hashes, one per line. Each is checked and the results are shown in a sortable table you can export to CSV, JSON, or TXT — useful for triaging IOCs from an incident or a threat feed.
The Web Crypto API intentionally does not support MD5, so in-browser file hashing is offered for SHA-256 (recommended) and SHA-1. MD5 is still fine for pasting an existing MD5 hash to look it up — many older malware feeds key on MD5.
Use SHA-256. It is the current standard and what most threat-intelligence feeds key on. MD5 and SHA-1 are still found in older databases and are supported for lookup, but both have known collision weaknesses and should not be relied on for new work.
No. Hash lookup matches exact, previously-seen hashes only. A not-found result means the hash is not in our known-malware list — it is not proof of safety. New, polymorphic, or packed malware produces a fresh hash each time and will not match. Confirm uncertain files on VirusTotal/MalwareBazaar and use behavioral analysis when in doubt.
No. The tool does not call the VirusTotal API. Reputation is checked against a local known-malware list, and each result includes a deep-link that opens VirusTotal's and MalwareBazaar's public results pages for that hash — a fast, no-account way to get an authoritative multi-engine verdict.
Yes. A single-hash or file-hash result updates the page URL with the hash (for example ?hash=…), so you can copy the link and share it. Opening that link re-runs the lookup automatically.
Yes. Computing a file's hash and checking it against malware databases is a standard, legitimate security practice used in malware triage, incident response, and threat hunting. The tool only fingerprints files you provide and never accesses file contents beyond computing the hash.