HashWatch#
HashWatch maintains a continuously updated library of cryptographic hashes for widely-deployed software. Updated every day from official vendor sources - no login, no account, no API key required.
What it does#
HashWatch fetches the official hash of each software release directly from the vendor and publishes the results on a public dashboard. If a file on an endpoint matches a hash in HashWatch, you know it is the genuine vendor release.
Use it to answer one question quickly:
Is this file the real vendor binary, or has it been tampered with?
At a glance#
| Coverage | 130 vendor fetchers across Windows, Linux, macOS, Android, and packages |
| Triage corpus | NIST NSRL - ~72 million known-file hashes (BinTrust) |
| Refresh | Vendor sources fetched daily at 10:00 UTC; dashboard cache TTL 1 hour |
| Hashes | SHA-256 always; SHA-1 and MD5 where the vendor publishes them |
| Access | Dashboard + JSON feed are public; threat-intel API needs a key |
| Extras | RevokeRadar (revoked signing certs) · SigDiff (Authenticode signer chain) |
New here? Start with the FAQ or Getting Started.
Using the dashboard#
Open the public dashboard in any browser. No account is needed.
API access#
Integrate HashWatch into your SIEM, IR workflow, or security tooling using the authenticated API. Requires an API key - contact your administrator.
BinTrust - known-good hash lookup#
Submit any hash (SHA-256, SHA-1, or MD5) and get back an instant triage classification: known_vendor_release, known_file (NSRL corpus), or unknown.
curl -X POST https://api.hashwatch.us/api/v1/intel/lookup \
-H "X-API-Key: <team-id>.<secret>" \
-H "Content-Type: application/json" \
-d '{"hashes": ["b94d27b9934d3e08a52e52d7da7dabfac484efe04294e576e9e7c3e07ccb1e83"]}'RevokeRadar - revoked signing certificates#
A genuine binary can still be a problem if the certificate that signed it has been revoked (for example, after the signing key is compromised). RevokeRadar continuously checks the code-signing certificates of tracked software against CA revocation lists (CRLs) and flags any that are revoked - on the public dashboard and via the intel:revocations API.
SigDiff - who signed it#
For every Windows binary, HashWatch records the Authenticode signing identity (signer, issuer, serial, thumbprint), so you can confirm not just that a file’s bytes are genuine but that it was published by the expected identity - and pivot across your estate on the certificate thumbprint.
Covered software#
HashWatch tracks 100+ common applications across Windows, Linux, macOS, and Android - security tools, browsers, runtimes, interpreters and other living-off-the-land targets, remote-access and collaboration apps - plus the NIST NSRL reference corpus for broader triage coverage. Browse exactly what’s covered today (each record shows its source and verification status) on the public dashboard.