Is this file, link, domain or IP known-malicious?
Checks VirusTotal’s existing scan results via VTAI, VirusTotal’s free API for AI agents — no API key, no account. This retrieves an existing result; it never triggers a new scan. A URL check sends the complete URL (including anything after ? or #) to VirusTotal — use the domain check instead if the link might carry a token or private data.
How this works
This tool proxies your lookup through PlayCISO’s own registration with VirusTotal’s VTAI API — you never need your own account or key. Lookups are rate-limited per visitor to stay well within VTAI’s shared quota. Want the full picture on what VTAI is and the governance considerations before wiring it into your own AI agents? Read the explainer and the rollout checklist.
Loading…
How a file hash reputation check works
A hash reputation check looks up a file's cryptographic fingerprint (its SHA-256, SHA-1 or MD5 hash) against existing scan results, without uploading the file. This tool checks the hash against VirusTotal's existing results via VTAI.
- Compute the hash locally:
sha256sum fileon Linux,shasum -a 256 fileon macOS orGet-FileHash filein PowerShell, or drop the file into the Hash Generator, which hashes it in your browser. - Choose File hash, paste the value and run the lookup.
- Read the result. Engine detections mean the file is known to be malicious; "no existing scan result" means unknown, not safe.
Prefer SHA-256. MD5 and SHA-1 both have practical collision attacks, so a match on them is weaker evidence that two files are identical. Any change to a file changes its hash, so a hash check only recognises files that have been seen before: repacked or brand-new malware will not match.
Frequently asked questions
How do I check a file hash’s reputation?
Compute the file’s SHA-256 (or SHA-1/MD5) hash locally, for example with sha256sum, shasum -a 256 or PowerShell’s Get-FileHash, then look the hash up against existing scan results. Only the hash is sent, never the file. A result with no detections, or no existing scan, means the file is unknown, not that it is safe.
Do I need a paid plan?
It is a Pro tool included with any PlayCISO paid plan. It proxies your lookup through PlayCISO’s own registration with VirusTotal’s free VTAI API for AI agents, rate-limited per visitor to stay within VTAI’s shared free quota.
Does this start a new scan?
No. It only retrieves an existing scan result already on file at VirusTotal. If nothing has scanned that file, URL, domain or IP before, you’ll see "no existing scan result" rather than a fresh analysis.
Is my file uploaded when I check a hash?
No. A hash check only ever sends the hash itself, never the file. If you want a file actually scanned rather than just checked against prior results, you’d need to submit it directly to VirusTotal.
What data does a URL check send?
The complete URL, including everything after a ? or #. If the link might contain a session token, API key, or other private data in its query string, check the domain instead.
What does "no existing scan result" mean?
It means VirusTotal hasn’t seen that specific hash, URL, domain or IP before — not that it’s confirmed safe. A brand-new or rarely-seen artifact can be malicious and still show no detections simply because nothing has scanned it yet.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.