Check file hashes (MD5, SHA-1, SHA-256) against known malware databases. Upload a file to compute and verify its hash.
Upload a file and this checker computes its MD5, SHA-1, and SHA-256 digests, then compares each against a collection of hashes associated with known malware. The comparison is exact-match, so the answer it gives is narrow: this exact file has been seen before, or it has not. The most common misunderstanding is reading a no-match result as proof of safety. Hashing is byte-sensitive: a one-bit change, a recompiled build, or a brand-new sample produces hashes nobody has cataloged, and the checker reports the same no-match it would for a perfectly clean file.
A concrete input and expected output from the current implementation.
Input
A file whose entire content is the five ASCII bytes hello (h-e-l-l-o, no trailing newline).
Expected output
MD5: 5d41402abc4b2a76b9719d911017c592, SHA-1: aaf4c61ddcc5e8a2dabede0f3b482cd9aea9434d, SHA-256: 2cf24dba5fb0a30e26e83b2ac5b9e29e1b161e5c1fa7425e73043362938b9824, and a database lookup with no match.
These are the standard published test-vector digests for the five-byte string hello; hashing is deterministic, so any correct implementation produces these values. This benign sample's hashes do not appear in malware collections, so the lookup returns no match.
The checker reads the uploaded file and runs three standard algorithms over its bytes: MD5, SHA-1, and SHA-256. Each produces a fixed-length hexadecimal digest, 32, 40, and 64 characters respectively. Because every byte of the file contributes to every digest, a one-bit difference anywhere changes all three results completely, and the same file always yields the same three values.
Each computed digest is compared against hashes in a collection built from known malware samples. A file is flagged only when a digest equals a stored value character for character. The collection catalogs specific files, not families or behaviors, so re-packed, recompiled, or renamed variants of a known threat typically do not match, and a file never seen before cannot be flagged at all.
No. It means this exact file's hashes are not in the collection, which is also the result a brand-new sample or a modified copy would produce. Unknown is not clean, so consider the file's source, verify against the publisher's checksum when one exists, and open high-risk files only in a sandbox or disposable virtual machine.
VirusTotal runs the file through many antivirus engines and community reports, which can catch heuristic and behavioral signals. This checker compares hashes only, so anything its collection has not cataloged is invisible to it. A no-match here does not mean other engines would stay quiet, and submitting a file to a third-party service is itself a disclosure.
The example and behavioral notes were checked against the browser implementation. Standards and primary references below define the relevant format, formula, or platform behavior.
Generate strong, random passwords with customizable length, character sets, and complexity requirements.
Analyze password strength with entropy scoring, crack-time estimates, and improvement suggestions.
Create cryptographically random strings for API keys, tokens, salts, and unique identifiers.
Create QR codes for URLs, text, Wi-Fi credentials, vCards, and more with customizable size and colors.
Scan and decode QR codes from uploaded images or your device camera to extract embedded data.
Compute MD5, SHA-1, SHA-256, and SHA-512 checksums to verify file integrity and detect tampering.