Authentication

Mon, 01 Jan 0001 00:00:00 +0000

Authentication#

API Keys#

HashWatch uses API keys for authentication on all private endpoints. An API key looks like this:

<team-id>.<secret>

For example: acme-ir.sk_live_a1b2c3d4e5f6...

Sending your API key#

Include your key in the X-API-Key header on every request:

curl https://api.hashwatch.us/api/v1/intel/stats \
 -H "X-API-Key: acme-ir.sk_live_a1b2c3d4e5f6..."

API keys are never logged or stored in plaintext — only a secure HMAC hash is kept on the server. Keep your key confidential; it cannot be recovered if lost (request a new one from your administrator).

Covered Software

Mon, 01 Jan 0001 00:00:00 +0000

Covered Software#

HashWatch tracks 56 vendor fetchers covering Windows, Linux, macOS, and Android. All hashes are refreshed every day at 02:00 UTC. Versions are always discovered dynamically — HashWatch never hardcodes a vendor version number.

Each record’s Source link on the dashboard points to the exact per-OS/arch file the hash was computed from.

Security & Endpoint Tools#

Vendor	Product	Platforms	How hashes are obtained
Microsoft	PowerShell	Windows (x64/x86/ARM64), Linux, macOS	Official GitHub release assets with `.sha256` files
Microsoft	OpenSSH for Windows	Windows	Official GitHub release assets with `.sha256` files
Git for Windows Project	Git for Windows	Windows (x64/x86/ARM64)	GitHub release assets with `.sha256.txt` files
Simon Tatham	PuTTY, PLink, PSCP, PSFTP	Windows	Official `sha256sums` manifest file
Microsoft (Sysinternals)	PsExec, ProcMon, ProcExp, Autoruns, TCPView, Handle, Strings, ProcDump	Windows	Suite ZIP downloaded in memory; individual EXEs hashed†
KeePassXC Team	KeePassXC	Windows, macOS, Linux	GitHub release DIGESTS asset
Bitwarden Inc.	Bitwarden Desktop	Windows, macOS, Linux	GitHub release `.sha256` assets
Bitwarden Inc.	Bitwarden Android	Android (Google Play + F-Droid)	GitHub release sha256 text files (manifest; no download)
Wireshark Foundation	Wireshark	Windows (x64/ARM64), macOS, Linux	Wireshark CDN per-file `.sha256` files
IDRIX	VeraCrypt	Windows (x64/x86/ARM64), macOS, Linux	GitHub release `sha256sum.txt` sidecar

Browsers#

Vendor	Product	Platforms	How hashes are obtained
Mozilla Foundation	Firefox	Windows (x64/x86), macOS, Linux	Mozilla official `SHA256SUMS` manifest file
Mozilla Foundation	Firefox for Android (Fenix)	Android (arm64, arm)	GitHub release APK assets; downloaded and hashed in memory†
Mozilla Foundation	Thunderbird	Windows (x64/x86), macOS, Linux	Mozilla official `SHA256SUMS` manifest file
Google LLC	Chrome Enterprise	Windows (x64/x86), macOS, Linux	Binary downloaded, hashed in memory, discarded†
Microsoft Corporation	Microsoft Edge	Windows (x64/ARM64), macOS, Linux	Manifest — Microsoft enterprise update API
Brave Software Inc.	Brave Browser	Windows (x64/x86/ARM64), macOS, Linux	GitHub `.sha256` sidecars for all installer assets
Brave Software Inc.	Brave Android	Android (arm64 universal, arm64 mono, arm, x64, x86; APK + AAB)	GitHub `.sha256` sidecars for all APK/AAB assets

Communication & Messaging#

Vendor	Product	Platforms	How hashes are obtained
Signal Foundation	Signal Desktop	Windows (x64/ARM64), macOS, Linux	Binary downloaded, hashed in memory, discarded† — YAML version file used
Signal Foundation	Signal Android	Android (universal APK)	Manifest — `updates.signal.org/android/latest.json` (no download)
Zoom Video Communications	Zoom	Windows, macOS, Linux	Binary downloaded, hashed in memory, discarded†
Slack Technologies	Slack	Windows, macOS, Linux	Binary downloaded, hashed in memory, discarded†
Microsoft	Microsoft Teams	Windows (x64/ARM64), macOS	Binary downloaded, hashed in memory, discarded†
Telegram Messenger	Telegram Desktop	Windows (x64/ARM64), macOS, Linux	GitHub release assets; downloaded and hashed†
Telegram Messenger	Telegram FOSS Android	Android (universal APK)	GitHub release APK; downloaded and hashed† (Telegram-FOSS-Team fork)
Discord Inc.	Discord	Windows, macOS, Linux	Always-latest CDN; downloaded and hashed†
Meta Platforms Inc.	WhatsApp	Android (universal APK)	Meta stable APK URL; downloaded and hashed†

Runtimes & Interpreters#

Vendor	Product	Platforms	How hashes are obtained
OpenJS Foundation	Node.js v20 LTS, v22 LTS	Windows, macOS, Linux	Official `SHASUMS256.txt` manifest
Google (Go)	Go toolchain	Windows, macOS, Linux	`go.dev/dl/?mode=json` manifest
Python Software Foundation	Python	Windows, macOS, Linux	Binary downloaded, hashed in memory, discarded†
Eclipse Foundation (Adoptium)	Temurin JDK 21 LTS, JDK 25	Windows, macOS, Linux	Adoptium REST API (SHA-256 in JSON response)

Developer Tools#

Vendor	Product	Platforms	How hashes are obtained
Microsoft	VS Code	Windows, macOS, Linux (all architectures)	VS Code Update API (returns SHA-256 directly)
Notepad++ Project	Notepad++	Windows (x64/x86/ARM64)	GitHub release assets with `.sha256` files
Igor Pavlov	7-Zip	Windows (x64/x86), Linux (x64/ARM64)	Binary downloaded, hashed in memory, discarded†
GitHub Inc.	GitHub CLI	Windows, macOS, Linux	GitHub release `checksums.txt` manifest
FileZilla Project	FileZilla	Windows, macOS	Binary downloaded, hashed in memory, discarded†
Nmap Project	Nmap	Windows, macOS	Binary downloaded, hashed in memory, discarded†

Infrastructure & Cloud Tools#

Vendor	Product	Platforms	How hashes are obtained
HashiCorp	Terraform, Vault, Packer, Consul, Nomad, Vagrant, Boundary	Windows, macOS, Linux	`releases.hashicorp.com` `SHA256SUMS` manifest
Cloud Native Computing Foundation	kubectl	Windows, macOS, Linux	`dl.k8s.io` per-file `.sha256` files
Amazon Web Services	AWS CLI v2	Windows, macOS, Linux	Binary downloaded, hashed in memory, discarded†

Remote Access & Virtualisation#

Vendor	Product	Platforms	How hashes are obtained
AnyDesk Software GmbH	AnyDesk	Windows, macOS, Linux (amd64 + ARM64)	Binary downloaded, hashed in memory, discarded† — version discovered dynamically
TeamViewer	TeamViewer Host & Client	Windows, Linux	Binary downloaded, hashed in memory, discarded† — stable always-latest CDN URLs
RustDesk	RustDesk	Windows, macOS, Linux	GitHub release assets; downloaded and hashed†
Oracle Corporation	VirtualBox	Windows, macOS, Linux	`download.virtualbox.org` `SHA256SUMS` manifest

Productivity#

Vendor	Product	Platforms	How hashes are obtained
The Document Foundation	LibreOffice	Windows, macOS, Linux	documentfoundation.org `.sha256` manifest files
OBS Project	OBS Studio	Windows, macOS, Linux	GitHub release assets; downloaded and hashed†
VideoLAN Organisation	VLC Media Player	Windows (x64/x86), macOS	VideoLAN update API + per-file sha256 manifest

Android — Authenticators, Password Managers & Communication#

Vendor	Product	Platforms	How hashes are obtained
Beem Development	Aegis Authenticator (TOTP/HOTP)	Android (universal APK)	GitHub release APK; downloaded and hashed† (release build only)
Kunzisoft	KeePassDX	Android (universal APK)	GitHub release APK; downloaded and hashed†
AgileBits Inc.	1Password	Windows	Manifest — AgileBits product history JSON API
WireGuard / Jason Donenfeld	WireGuard	Android (universal APK)	GitHub APK; F-Droid manifest fallback
Proton AG	Proton Mail	Android (universal APK)	GitHub APK; F-Droid manifest fallback

† What “hashed in memory, discarded” means#

For vendors that don’t publish a separate hash file, HashWatch downloads the binary over HTTPS, streams it through the SHA-256/SHA-1/MD5 algorithms without writing the file content to disk, and then closes the connection. The binary content never touches the server filesystem.

Public Dashboard

Mon, 01 Jan 0001 00:00:00 +0000

Public Dashboard#

The public dashboard shows today’s known-good cryptographic hashes for all tracked software. No account, API key, or login is required.

Open it in any browser:

https://hashwatch.us/

Navigating the dashboard#

Records are grouped by operating system — All / Windows / Linux / macOS / Android. Tabs with no current records are hidden automatically. Pick a platform, then use the search box to filter by executable name, vendor, or hash value.

Endpoints

Mon, 01 Jan 0001 00:00:00 +0000

Endpoints#

Base URL: https://api.hashwatch.us

Public endpoints (no authentication)#

GET /public/hash-of-day#

Returns today’s known-good hashes for all tracked software. Results are cached for up to 1 hour.

curl https://api.hashwatch.us/public/hash-of-day

Add ?date=YYYY-MM-DD to retrieve a specific day’s snapshot:

curl "https://api.hashwatch.us/public/hash-of-day?date=2026-06-01"

Response:

{
 "date": "2026-06-05",
 "generated_at": "2026-06-05T02:14:37Z",
 "cache_hit": true,
 "hashes": [
 {
 "id": "...",
 "executable_name": "chrome-win64.msi",
 "version": "124.0.6367.82",
 "vendor": "Google LLC",
 "platform": "windows",
 "arch": "amd64",
 "hash_sha256": "b94d27b9934d3e08a52e52d7da7dabfac484efe04294e576e9e7c3e07ccb1e83",
 "hash_sha1": null,
 "hash_md5": null,
 "source_url": "https://dl.google.com/...",
 "download_verified": true,
 "valid_from": "2026-06-05T02:13:01Z",
 "sig_signer": "Google LLC",
 "sig_issuer": "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1",
 "sig_serial": "0a...",
 "sig_thumbprint": "1a2b..."
 }
 ]
}

Fields:

HashWatch Documentation on HashWatch Docs

Authentication

Authentication#

API Keys#

Sending your API key#

Covered Software

Covered Software#

Security & Endpoint Tools#

Browsers#

Communication & Messaging#

Runtimes & Interpreters#

Developer Tools#

Infrastructure & Cloud Tools#

Remote Access & Virtualisation#

Productivity#

Android — Authenticators, Password Managers & Communication#

† What “hashed in memory, discarded” means#

Public Dashboard

Public Dashboard#

Navigating the dashboard#

Endpoints

Endpoints#

Public endpoints (no authentication)#

GET /public/hash-of-day#