Public Dashboard#

The public dashboard shows today’s known-good cryptographic hashes for all tracked software. No account, API key, or login is required.

Open it in any browser:

https://hashwatch.us/

Navigating the dashboard#

The dashboard is a two-column console. The left rail carries the filters and the day’s signed-root panel; the main panel holds the status header, the “Verify a hash” box, search, and the product cards.

The dashboard renders in dark theme by default. A theme toggle (Light / Dim / Dark / High Contrast) is in the header if you prefer another appearance.

Left-rail filters#

Filter	What it narrows by
Operating system	Windows / Linux / macOS / Android (variants with no current records are hidden)
Category	Browsers · Developer · Cloud & DevOps · Security · Communication · Remote access · Networking · Productivity & media · Packages · Other
Source	How the software is licensed / published: Open Source · Source Available · Freeware · Proprietary · Mixed
Architecture	CPU architecture (`amd64`, `arm64`, `arm`, `x86`, `universal`)

The left rail also shows the day’s Ed25519 signed-root panel - the signed Merkle root over the current published feed, so you can confirm the data you are viewing has not been altered.

Main panel#

A status header summarises the current feed. Below it are the “Verify a hash” box (see below), a search box (filter by executable name, vendor, or hash value), a Legend, and an Expand-all control.

Records are grouped into product cards - one card per product, gathering that product’s variants (different operating systems, architectures, or package formats). Each card carries a source badge and any applicable LOTL / FuzzPrint / REVOKED indicators. Each card is collapsed by default; click it to expand every variant with its SHA-256 / SHA-1 / MD5 and a copy button.

No account is required to browse any of this.

Verify a hash#

The main panel has a “Verify a hash” box. Paste any SHA-256, SHA-1, or MD5 value into it and HashWatch tells you whether it is known-good - no need to hunt through the cards manually.

Without signing in, you get an instant check against today’s published feed (the same set the dashboard shows).
Signed-in paid accounts (basic and up) additionally verify against the full known-good corpus, including older / superseded versions. The result reports either a matching vendor build (with its version, and an “older/superseded” note when the match is not the current release), a reference-corpus (NSRL) match, or not found.

The programmatic equivalents are POST /api/v1/intel/lookup and POST /api/v1/intel/lookup/historical - see Endpoints and BinTrust.

What the table shows#

Column	Description
File	Filename as a direct download link - clicking fetches the exact binary file from the vendor
Version	The release version (always discovered live - never hardcoded)
Arch	CPU architecture (`amd64`, `arm64`, `arm`, `x86`, `universal`)
SHA-256	64-character hex hash. Click the ⧉ button to copy the full value
SHA-1	40-character hex hash - blank if the vendor only publishes SHA-256
MD5	32-character hex hash - blank if the vendor only publishes SHA-256
Signer	Authenticode subject of the signing certificate. Hover for issuer, serial, and thumbprint. Blank for non-PE formats or manifest-only vendors.
Site	Link to the vendor’s release directory or tag page (the parent path before the file, so you see the source rather than triggering a download)
Verified	`✓ verified` - HashWatch downloaded the binary itself; `manifest` - taken from the vendor’s published checksum file

Each product card can also carry indicator chips:

Indicator	Meaning
LOTL	This tool is catalogued in GTFOBins or LOLBAS - attackers abuse the legitimate binary for living-off-the-land. Compare a suspect copy’s hash against these values to confirm it is the genuine vendor build and not a swapped or trojanized one.
FuzzPrint	Similarity fingerprints (imphash / ssdeep / TLSH) are available - expand the card to view and copy them.
REVOKED	The binary’s code-signing certificate was later revoked (RevokeRadar).

Comparing a suspicious file#

Compute the SHA-256 of the file you want to check.
Windows (PowerShell):
```
Get-FileHash -Algorithm SHA256 .\file.exe | Select-Object Hash
```
Linux / macOS:
```
sha256sum file.exe
```
Open the dashboard and paste your computed hash into the “Verify a hash” box for an instant match against today’s feed. (Signed-in paid accounts also match older / superseded versions and the reference corpus - see Verify a hash above.)
Alternatively, filter to the right product, expand its card, and click the ⧉ button next to the SHA-256 to copy the published value and compare it against your computed hash manually.

Result	Meaning
Hashes match	The file is byte-for-byte identical to the current vendor release
Hashes differ	The file does not match - investigate further
Executable not listed	HashWatch does not track this software

A matching hash does not guarantee safety. It means the file matches what the vendor distributed. A supply-chain compromise at the vendor level would still produce a matching hash. Treat hash verification as one signal alongside other detections.

When is the data updated?#

HashWatch fetches from vendor sources every day at 10:00 UTC. The dashboard cache has a 1-hour TTL - you may see data up to 1 hour old.

JSON endpoint#

The dashboard data is also available as JSON - no authentication needed:

GET https://api.hashwatch.us/public/hash-of-day

curl https://api.hashwatch.us/public/hash-of-day

Response:

{
  "date": "2026-06-04",
  "generated_at": "2026-06-04T02:14:37Z",
  "cache_hit": true,
  "hashes": [
    {
      "executable_name": "chrome-win64.exe",
      "version": "124.0.6367.82",
      "vendor": "Google LLC",
      "platform": "windows",
      "arch": "amd64",
      "hash_sha256": "b94d27b9934d3e08a52e52d7da7dabfac484efe04294e576e9e7c3e07ccb1e83",
      "hash_sha1": null,
      "hash_md5": null,
      "source_url": "https://dl.google.com/...",
      "download_verified": true,
      "valid_from": "2026-06-04T02:13:01Z",
      "sig_signer": "Google LLC",
      "sig_issuer": "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
      "sig_serial": "0a123456789abcdef...",
      "sig_thumbprint": "1a2b3c4d..."
    }
  ]
}

This endpoint returns only the current day. Historical snapshots require an API key (a Teams-tier feature via the authenticated history endpoint); requesting a past date here is not supported.