Known Goods

Download cryptographic hashes and scan the file content of OEM software.

Buy hashes now

Features

Full Downloads

Our entire hash database is downloadable for efficient offline usage

33 Hash types

File content is run through 33 different hash and checksum types

API Accessible

Search hashes and gather file detail via our blazingly-fast API

Updated NSRL

Search and download always-up-to-date NSRL RDS data

Full Content

Rescan full file content to compute new hashes, conduct research, and more

Flexible output

SQL, CSV, JSON, Parquet, and Bloom to HTTPS download, S3, and GCS

Our Approach

How we collect our hashes and keep them updated.

1

Trusted Media

We start with original content from OEMs and trusted/verified third parties

2

Full Feature Install

All features are enabled during installation and if it comes down to it, we always choose options common to enterprise environments

3

Collect and Hash

File name, path, and other metadata is collected and hashes are computed for their content.

4

Rescan Updates

Installations are regularly updated and rescanned to capture changes

28m
Unique Hashes
932
Products
292
Operating Systems
May 1
Last Update (2021)

Algorithms We Support

Adler-32
ContentHash
CRC32
CRC32b
GOST
HAVAL-128
HAVAL-160
HAVAL-192
HAVAL-224
HAVAL-256
MD5
MD5-W
RIPEMD-128
RIPEMD-256
RIPEMD-320
sdhash
SHA-1
SHA-224
SHA-256
SHA-384
SHA3-224
SHA3-256
SHA3-384
SHA3-512
SHA-512
Snefru-128
Snefru-256
ssdeep
Tiger/128
Tiger/160
Tiger/192
TLSH
Whirlpool

Goodies

pyhashdd

At hashdd's core is pyhashdd, a killer Python library for profiling files and building hash databases. You can use pyhashdd as a command line tool or a python import to make your own hashdd, or query our API.

Bloom Filters

Our Bloom Filters allow of super fast offline lookups and are built using popular open source libraries. This enables you to include hashdd data in your own applications!

Query the API

Use our API for enrichment and quick Good/Unknown determination on hashes. You can find the details of our endpoints in the API Swagger Documentation.

Hash known level lookup with curl

The /v1/knownlevel/<hash> endpoint provides simple, Good/Unknown determinations on hashes.

curl https://api.hashdd.com/v1/knownlevel/838DE99E82C5B9753BAC96D82C1A8DCB

{"result": "SUCCESS", "message": null, "hash": "838DE99E82C5B9753BAC96D82C1A8DCB", "knownlevel": "Good"}

NSRL RDS lookup with curl

Most endpoints also have an NSRL RDS-only companion. For instance, to lookup only NSRL RDS known levels, query the /v1/knownlevel/nsrl/<hash> endpoint.

curl https://api.hashdd.com/v1/knownlevel/nsrl/838DE99E82C5B9753BAC96D82C1A8DCB

{"result": "SUCCESS", "message": null, "hash": "838DE99E82C5B9753BAC96D82C1A8DCB", "knownlevel": "Good"}

Detail lookup with curl

Our /v1/detail/<hash> endpoint provides filenames, products, version, and other details about a hash.

curl https://api.hashdd.com/v1/detail/0000095897E650E4C352EF29EA027713

{ "result": "SUCCESS",
  "message": null,
  "search_results": [
    {
      "result": "SUCCESS",
      "message": null,
      "hash": "0000095897E650E4C352EF29EA027713",
      "details": {
        "hashdd_sha512": "02C726A4B3E3938248EEE7EFCC02B8FFA66C0329A06C654CE5CE984179ECC010670CA7CB32609954CD4CDD13D48CB136A019DF22FF7D0FEF2ADF9B7621AE5E87",
        "hashdd_sha3_384": "05E2E905E06C579B2A26F71F75ED024D7D0F78B3C88AAAE2D092A5E123...",
        .
        }
    }, .... ] }

Pricing

Individual

$ 0
FREE Forever
  • 100 API Queries/day
  • Unlimited WebUI searches
  • NSRL Bloom Filters
  • NSRL Hash Lists
  • Full Hash Database Download
  • Output as SQL, CSV, JSON, Parquet and Bloom
  • Access via HTTPS or direct S3/GCS upload
  • Customer Support
  • Custom output formats or access methods
  • Full Content Scans

Enterprise

Let's Talk!
  • Unlimited API Queries/Day
  • Unlimited WebUI searches
  • NSRL Bloom Filters
  • NSRL Hash Lists
  • Full Hash Database Downloads
  • Customer Support
  • Output as SQL, CSV, JSON, Parquet and Bloom
  • Access via HTTPS or direct S3/GCS upload
  • Custom output formats or access methods
  • Full Content Scans