Is this attachment safe to open?

Drop the file here. Your browser inspects it locally — what it really is, whether it hides macros, scripts or programs — and sends only a fingerprint (SHA-256 hash) to check malware databases.

Nothing is uploaded. The file is read on your device. Only its SHA-256 hash (a fingerprint that cannot be reversed) is sent to look up known malware.

How the attachment checker works

  1. Drop the file

    It is read by your browser. It is not uploaded, stored or sent anywhere.

  2. We look at the real content, not the name

    The first bytes tell us if a "PDF" is really a Windows program, whether an Office document contains a macro project, and whether a PDF carries JavaScript or auto-run actions.

  3. Only the fingerprint is looked up

    We compute the SHA-256 hash and ask abuse.ch MalwareBazaar (and VirusTotal, where enabled) whether that exact file is known malware.

Questions people ask

Is my file uploaded anywhere?

No. Everything runs in your browser. The only thing sent is a 64-character hash that cannot be turned back into the file.

The result says "not known to be bad". Is it safe?

It is not known malware. New malware is produced faster than databases can catalogue it, so also weigh the other findings and whether you expected the file.

Which attachments are most dangerous?

Programs and scripts (.exe, .js, .vbs, .lnk, .iso), macro-enabled Office files (.docm, .xlsm), HTML attachments that mimic login pages, and ZIPs containing any of these.

Built and maintained by the Arventiq Labs team in Bengaluru. Free for anyone, source on GitHub (MIT). Results are indications, not verdicts. Something wrong? Tell us.