Is This File Safe? File Safety Check and Suspicious Link Checker
Free file safety check: drop files or a whole folder to see what each one really is and spot the tricks malware uses, like programs disguised as PDFs, double endings, Office macros, PDF JavaScript, password-protected zips and phishing pages. Get SHA-256 hashes to look up on VirusTotal, check suspicious links, and learn how to really scan your computer. Nothing is uploaded.
Honest first: a web page can't scan your computer. It can't see your other programs, running processes or system files, and it has no virus database. What this page can do is look closely at files you give it, right here in your browser, and spot the tricks most malware relies on. For a real scan of your computer, see How to really scan your computer.
🔒 Private: files are read inside your browser and are never uploaded. Only if you click "Look up on VirusTotal" does that site receive the file's fingerprint (hash), never the file.
Results
"No red flags" only means none of the tricks this page knows about were found. It does not mean a file is safe: new malware can look completely normal. If you didn't expect a file, don't open it.
Checking is done in your browser: the link is not visited and not sent anywhere until you press one of the VirusTotal, Google Safe Browsing or urlscan.io buttons that appear below.
How to really scan your computer
Only software running on the computer itself can scan it. The good news: Windows and macOS already include one, and it is free.
🪟 Windows 10 and 11: Microsoft Defender (built in)
- Open Start, type Windows Security and open it.
- Go to Virus & threat protection. Under Virus & threat protection updates, choose Protection updates → Check for updates first.
- Back in Virus & threat protection, choose Scan options, pick Full scan and press Scan now. It can take an hour or more; you can keep working.
- If you think something is hiding, run the Microsoft Defender Antivirus (offline scan) from the same Scan options list. The computer restarts and scans before Windows starts (about 15 minutes), which finds malware that hides while Windows is running. Save your work first.
- Afterwards check Protection history (same page) to see what was found and removed.
Another antivirus may have turned Defender's real-time protection off; that is normal, but then run a full scan in that program instead. Microsoft also offers a free one-time scanner, the Microsoft Safety Scanner, as a second opinion.
🍎 Mac
- macOS has XProtect built in. It checks apps when you open them and removes known malware in the background. There is nothing to start: keep it current by keeping macOS updated (System Settings → General → Software Update, and turn on Automatic updates including "Install Security Responses and system files").
- For a scan you can start yourself, the free version of Malwarebytes for Mac scans and removes adware and malware (the paid real-time protection is optional).
- Check System Settings → General → Login Items & Extensions for things that start by themselves that you don't recognise, and Privacy & Security → Profiles (if present) for configuration profiles you didn't install.
🧩 Check your browser extensions (the most common hiding place for adware)
- Open the extensions page: Chrome
chrome://extensions, Edgeedge://extensions, Bravebrave://extensions, Firefoxabout:addons, Safari Settings → Extensions. - Remove anything you don't remember installing, don't use, or that asks to "read and change all your data on all websites" without a good reason.
- Be wary of extensions that changed your search engine or new-tab page. Check Settings → Search engine and On start-up too.
- Chrome and Edge have a Safety Check (Chrome: Settings → Privacy and security → Safety Check) that flags harmful extensions and leaked passwords.
- If ads, pop-ups or redirects keep coming back, use Settings → Reset settings in the browser.
⚠ Signs that something may be wrong
- Pop-ups or ads where there were none, or your searches going to an unfamiliar search engine.
- New toolbars, extensions or programs you didn't install.
- Antivirus or Windows Update turned off and you can't turn it back on.
- Friends getting messages from you that you didn't send; password-reset e-mails you didn't ask for.
- Files renamed with strange endings and a "pay to get them back" note (ransomware).
- The computer is suddenly very slow, or the fan runs hard while it is idle (possible crypto mining). On its own this is usually something harmless.
🧯 What to do if you think you are infected
- Disconnect from the internet (Wi-Fi off or cable out) so nothing more is sent or downloaded.
- Run a full scan, then an offline scan (Windows) or Malwarebytes (Mac), as above.
- From a different, clean device, change the passwords of your e-mail first, then banking, then everything else, and turn on two-step verification.
- Tell your bank if you entered card or banking details anywhere suspicious.
- If it is ransomware, or the scans keep finding things, back up your documents (not programs) and reinstall the operating system, or ask a professional.
- Phones: on Android open the Play Store → your profile → Play Protect → Scan. On iPhone keep iOS updated and remove profiles you don't recognise (Settings → General → VPN & Device Management).
✅ Habits that prevent most infections
- Keep the operating system, browser and apps updated; most attacks use holes that are already fixed.
- Install software only from the maker's own site or the official app store.
- Don't open attachments or links you weren't expecting, even from people you know. Check them here first.
- Never click "Enable content" / "Enable macros" in a document from an e-mail.
- Turn on file name extensions (Windows File Explorer → View → Show → File name extensions) so "invoice.pdf.exe" can't hide.
- Keep a backup that isn't always connected (an external drive you unplug, or a cloud backup with version history).
🧪 Test that your antivirus works
The EICAR test file is a harmless 68-character text that every antivirus is designed to flag, so you can check it is switched on without touching real malware. Download it from eicar.org: your antivirus should block or quarantine it. You can also drop it on this page (or press "Try the antivirus test file") to see it recognised.
Is this file safe? A private file check in your browser
Most malware that reaches people arrives as an ordinary-looking file: an "invoice" that is really a program, a Word document that asks you to enable macros, a zip with a password in the e-mail, or a web page that pretends to be a login screen. This page reads each file you give it and explains, in plain words, what it really is and which of these tricks it uses. It works on whole folders too, and nothing leaves your computer.
What it checks
- What the file really is
- The first bytes of a file say what it is, whatever its name says. A Windows program (.exe), Mac or Linux program, shortcut or installer named like a PDF, picture or document is flagged as disguised.
- Name tricks
- Double endings (
invoice.pdf.exe), invisible right-to-left characters that flip the end of a name, and long runs of spaces that push the real ending out of view. - Office documents
- Macros (and whether they start by themselves), Excel 4.0 macro sheets, remote template injection, links that load objects from the internet, DDE fields, embedded programs and password protection.
- PDFs
- JavaScript, actions that run when the PDF opens, Launch actions, attached files, names disguised with #xx codes and object streams that hide them.
- Archives and disk images
- Every file inside a ZIP (including zips inside zips) is checked the same way; password-protected archives and zip bombs are flagged, and the top folder of ISO images is listed.
- Web pages, pictures and shortcuts
- Login forms in attachments (phishing), "HTML smuggling", scripts inside SVG pictures, and .url / .webloc / .lnk shortcuts that start programs or point at look-alike sites.
Questions
Is this an antivirus?
No. An antivirus compares files with millions of known threats and watches what programs do. This page has no virus list; it looks for warning signs in how a file is built. Use it as a second opinion before opening something, together with your antivirus, never instead of it.
What does the VirusTotal button send?
Only the SHA-256 fingerprint of the file, a 64-character code that can't be turned back into the file. VirusTotal then shows whether that exact file has been seen and what dozens of antivirus engines thought of it. If nobody has uploaded it before, it will say "not found", which tells you nothing either way. Uploading the file itself to VirusTotal shares it with security companies, so don't upload private documents.
A program I downloaded on purpose shows "Caution". Is it bad?
Not necessarily. Every program can change your computer, so they are always marked Caution. It is fine if it came from the maker's own website or an official store; "Danger" is kept for disguises and tricks that honest files don't use.
Why can't a website scan my whole computer?
Browsers deliberately keep web pages away from your files, programs and settings; that is what stops a malicious website from doing damage. A page can only read files you choose to give it.