Malware Hash Checker

Hash lookup answers one narrow question

It asks whether this exact file, byte for byte, has been seen and classified before. That is genuinely useful and strictly limited. Change a single byte and the hash changes completely, so a trivially modified variant of known malware returns no result at all. This is why hash-based detection is a first pass rather than a verdict, and why attackers repack payloads for each campaign.

A clean result means unknown, not safe

The distinction matters more than any other point here. A hash absent from every database means nobody has submitted or classified this file, which is exactly what you would expect for freshly compiled malware and for a targeted attack aimed at one organisation. Reading "no detections" as "safe" inverts the meaning of the result.

Detections are not unanimous, and should not be

Multi-engine services show results from dozens of scanners, and disagreement is normal. One or two detections out of seventy, particularly with generic names containing "Heuristic", "Suspicious" or "Gen", frequently indicate a false positive — packed installers, self-extracting archives and code-signing tools trigger these constantly. Ten or more detections with specific family names is a strong signal. The pattern of names carries more information than the count.

Which hash to submit

SHA-256 is the current standard and what threat intelligence indexes on. MD5 and SHA-1 are still widely published in indicator lists for historical reasons, and remain adequate for lookup even though they are broken for security purposes — an attacker constructing a collision to evade a lookup is a scenario that does not arise in practice.

Submitting files has consequences

Uploading a file to a public multi-scanner service makes it available to security researchers and, on many platforms, to paying subscribers. Confidential documents, internal binaries and anything containing credentials should not be submitted. Hash lookup carries none of that exposure, because the hash reveals nothing about content — which is a good reason to check the hash first and only submit the file if you must.

Where it fits in an investigation

Hash checking is fast triage. It quickly confirms known-bad files and quickly eliminates well-known good ones. Anything returning unknown needs behavioural analysis, sandbox execution or expert review — and the files that matter most in a real incident are usually the ones that return nothing.

Related tools

• Password Strength Checker — Measure password strength by entropy and pattern analysis rather than character-class rules. Checked entirely in your browser.
• Password Generator — Generate strong random passwords and passphrases in your browser using the Web Crypto API. Nothing is transmitted, logged or stored.
• Hash Generator — Generate MD5, SHA-1, SHA-256 and SHA-512 hashes in your browser. Compare checksums and verify file integrity with nothing uploaded to a server.
• Base64 Encoder/Decoder — Encode and decode Base64 in your browser, including URL-safe Base64 and UTF-8 text. Handles files and data URIs locally with nothing uploaded.