Getting Started#

Everything on the HashWatch dashboard is public. Open it in any browser - no registration, no API key, no setup required.

Two ways to use HashWatch#

  1. The public dashboard / JSON feed - browse and search today’s known-good hashes, or pull them as JSON. No authentication. → Using the Public Dashboard

  2. The authenticated API - integrate hash verification into your SIEM or incident-response workflow (BinTrust lookup, statistics, history, RevokeRadar feed). Requires an API key from your administrator. → API Reference

How verification works, in three steps#

  1. Discover - for each tracked product, HashWatch finds the latest release version dynamically from the vendor (API, checksum file, or download headers). Nothing is hardcoded.
  2. Hash - the binary is streamed through SHA-256/SHA-1/MD5 hashers and discarded (never written to disk), or the hash is read from the vendor’s signed checksum manifest when a direct download isn’t possible.
  3. Publish - the result is recorded with an integrity signature and surfaced on the dashboard and API. Compare a file’s hash against it to confirm it is the genuine, unmodified vendor release.

New here? The FAQ answers the most common questions.

Backward HashWatch Documentation Public Dashboard Forward