Home / Features / Scan files for malware and spyware

Feature guide

Scan files for malware and spyware

Downloaded something and not sure it is safe? A file scan gives you a verdict in seconds, backed by detection engines and a community of people who may have seen the same file.

Files are the classic delivery vehicle for malware. An email attachment, a "cracked" app, a document from an unfamiliar sender, an installer from a search-engine ad — any of these can carry spyware, a trojan or ransomware. Scanning a file before you open it is one of the highest-value security habits you can build, and it takes about as long as reading this sentence.

What our file scanner checks

When you upload a file to the scanner, several things happen in sequence:

  • Hashing. The file's SHA-256 fingerprint is calculated. This uniquely identifies it and lets us recognise it instantly if it has been seen before.
  • Signature matching. The sample is checked against detection signatures for known spyware, stalkerware, trojans, ransomware, adware and potentially-unwanted programs.
  • Heuristic and behavioural analysis. Beyond known signatures, the scanner looks at structural and behavioural traits common to malicious files — packing, suspicious API usage, double extensions and more.
  • Reputation and community data. The file's history, how often it has been scanned, and how the community has voted all feed into the verdict.
A single file is checked against many engines at once.

Reading your file report

The result is designed to be readable by anyone. At the top is a risk score from 0 to 100 and a plain verdict: clean, suspicious or malicious. Below that, a detection table lists each engine that flagged the file and the name it assigned — for example Android.Spy.Agent or Win32.Stalkerware. You also see the file's hash, type and size, so you can be certain exactly what was analysed.

A high score with many engine detections is a clear signal to delete the file and not run it. A clean result is reassuring, though no scanner is infallible — combine it with common sense about where the file came from.

Which file types should you scan?

Anything executable or capable of running code deserves a scan, especially:

  • Installers and executables (.exe, .msi, .dmg, .pkg)
  • Mobile app packages (.apk, and .ipa metadata)
  • Scripts (.js, .vbs, .bat, .ps1)
  • Archives (.zip, .rar) that you are about to extract
  • Office documents with macros (.docm, .xlsm)

Be especially wary of double extensions like invoice.pdf.exe — a favourite trick that disguises an executable as a harmless document.

The same file scanned twice returns its cached history instantly.

Privacy when you upload

Scanning produces a public verdict tied to the file's hash and indicators — not to you. That shared data is what makes the community database valuable. However, because submissions contribute to that database, you should never upload files that contain personal secrets or confidential business data. If you only need to check a file's identity, its hash alone is often enough. See our privacy policy for the full detail.

From file scan to peace of mind

If a scan comes back malicious, the right steps are simple: do not open the file, delete it, and if you already ran it, change your passwords from a clean device and consider a deeper device check. Our guides on finding spy apps on Android and iPhone cover what to do next.

Build the habit: scan first, open second. It costs you fifteen seconds and can save you from a compromised device, a drained bank account or stolen personal data.

Try it now

You do not need an account. Head to the scanner, drop in the file you are unsure about, and read the verdict. If you spot something the engines missed, your vote and comment will help the next person who scans it.

Scan a file or URL now →

Frequently asked questions

Is the file scanner free?

Yes, file scanning is free and requires no account. Optional paid plans add monitoring and history.

What is the maximum file size?

The scanner accepts files up to 32 MB. For larger files, the SHA-256 hash can often be checked instead.

Do you keep my uploaded files?

Submissions are processed to generate a verdict and may be retained to improve detection, as described in our privacy policy. Avoid uploading sensitive files.

Why did a file I trust get flagged?

Legitimate tools sometimes use techniques that overlap with malware. Read the engine detail and community comments, which provide context the score alone cannot.

Related guides