Skip to content
  1. TraceFind
  2. Free tools
  3. Hash & file intelligence toolkit
Free tool

Hash & file intelligence toolkit

Hash a file or text, check a download against its published hash, find out what a file really is and what it contains, and identify an unknown hash with its hashcat mode.

Runs in your browser. Nothing is uploaded.
Drop a file to analyse or click to choose · any type, up to 512 MB

What the toolkit tells you

Hashes

A hash is a fingerprint of a file or text: change one byte and it changes completely. Software sites publish the SHA-256 of their downloads so you can check the file you received is the one they released. Paste that hash in the “Expected hash” field and the matching row turns green. MD5 and SHA-1 are still used as identifiers, but they are not safe against deliberate tampering.

Real file type

File extensions can be anything; the first bytes of a file usually cannot. The toolkit reads these “magic bytes” and warns when invoice.pdf is really a Windows program or when a name hides a second extension.

Entropy and strings

Entropy measures how random the bytes are, from 0 to 8. Text sits low, programs in the middle, and compressed or encrypted data near 8. The map shows where in the file that happens. Readable strings are pulled out with the URLs, email addresses and IP addresses they contain, a quick way to see what a script or program talks to.

Identify a hash

Paste a hash from a leak, a config file or a database dump to see which algorithms produce that format, and the hashcat mode to use for each.

Frequently asked questions

Is my file uploaded to check it?

No. Hashes, file type, entropy and strings are all worked out in your browser. The VirusTotal button opens a lookup of the SHA-256 only, and only when you click it.

Which hash should I use to verify a download?

SHA-256, or whatever the download page publishes. Compare the full value: the toolkit checks all algorithms at once and marks the one that matches.

Can it tell me if a file is malware?

Not on its own. A mismatched extension, a hidden program or very high entropy are warning signs, not proof. Look the SHA-256 up on VirusTotal and only run programs you trust.

Can a hash be reversed?

Not mathematically. Weak passwords can still be found by trying candidates until one gives the same hash, which is what hashcat does, and why slow formats like bcrypt and Argon2 exist.

More free tools

Email header analyzer

Trace an email back to the server that sent it and spot spoofed senders.

Open tool

Metadata viewer & remover

See the GPS location, device and author hidden in photos and documents, then strip it.

Open tool

Google dork generator

Ready-made search operators for a name, email, username, phone number or domain.

Open tool
Need the full picture? TraceFind searches an email, username or phone number across hundreds of sites and billions of breach records.
Start a search