OpenTools
Security

Suspicious File Scanner

Is this file safe? Spot disguised executables, fake extensions, macros and active content, and get a SHA-256 for a VirusTotal lookup. Runs in your browser.

🔒 Scans entirely in your browser — the file is never uploaded. This inspects the file's structure; it never opens or runs it.

Drop any file here to check it

Detects fake extensions, hidden executables, macros and active content.

About this tool

A quick sanity check for files from people you don't fully trust. Suspicious File Scanner reads a file's actual contents in your browser and flags the tricks that fool people: a file whose real type doesn't match its extension (the classic "video that's really an .exe"), executables and scripts, the right-to-left-override filename trick, macro-enabled Office documents, and PDFs or SVGs with auto-run JavaScript or launch actions. It also computes the file's SHA-256 so you can check it against VirusTotal with one click (only the hash is shared, never the file). Nothing is uploaded and the file is never opened or run. Important: this is a heuristic check, not antivirus, so a clean result is not a guarantee of safety.

How to use the Suspicious File Scanner

  1. Drop any file onto the page or click Choose file.
  2. Read the verdict and the list of findings, such as an extension that does not match the contents.
  3. Copy the SHA-256 or click Look up on VirusTotal to see antivirus results.
  4. Click Scan another file to check the next one.

Give us your feedback

Help us improve Suspicious File Scanner!

Frequently asked questions

How can a file pretend to be something else?

Windows hides known extensions by default, so invoice.pdf.exe can look like a PDF. Attackers also use a hidden right-to-left override character to reverse part of a filename, or give a program a harmless extension. The scanner reads the file's first bytes, its magic number, to find the real type.

Is my file uploaded?

No. The file is read in your browser and is never uploaded or run. If you click Look up on VirusTotal, only the SHA-256 fingerprint is sent to VirusTotal, never the file itself.

Is this a replacement for antivirus?

No. It is a heuristic check for common disguises and structural red flags, with no malware signatures, so a clean result is not a guarantee of safety. For anything important, check the hash on VirusTotal or scan the file with antivirus software.

What is a SHA-256 hash and why look it up?

SHA-256 creates a unique 64-character fingerprint of a file. If VirusTotal has seen the exact same file before, looking up the hash shows results from dozens of antivirus engines without uploading anything. The hash is calculated for files up to 64 MB.

What red flags does it look for?

Mismatched extensions, executables and scripts, Windows shortcuts, macro-enabled and legacy Office documents, the right-to-left override filename trick, PDFs with JavaScript or launch and auto-run actions, and SVG or HTML files with scripts. Files over 64 MB get a quicker header-only check.

Related tools