You can check almost any file for malware before you open it, and most of the tools you need are already on your computer or free online. The fastest route is to paste the download link into a free multi engine scanner such as VirusTotal, then let your browser and Microsoft Defender or macOS do their own checks once the file lands. Here is how each layer works and when to use it.
Step 1: Check the link before you download
A file cannot hurt you while it sits on a web server, so the safest moment to check it is before it ever reaches your drive. Online scanners can inspect a link for you:
- Right click the download button or link and choose Copy link address.
- Open virustotal.com and select the URL tab.
- Paste the link and press Enter.
- Read the result. A page with zero or one detection is usually fine. Several engines flagging the same link is a strong reason to stop.
VirusTotal, which is owned by Google, checks the address against many security vendors and blocklists at once. It does not always download and analyze the file behind the link, so treat a clean URL result as a good sign, not a guarantee.
Step 2: Let your browser do its built in check
Modern browsers already screen downloads in the background, and it is worth making sure that protection is switched on.
- Google Chrome: open Settings, then Privacy and security, then Security, and pick Enhanced protection. With it on, Chrome can ask to send a suspicious file to Google Safe Browsing for a deeper scan, including password protected archives if you supply the password. Google says those files are deleted shortly after a verdict.
- Microsoft Edge: Microsoft Defender SmartScreen checks downloads against a list of known bad files and warns you about rare or unknown programs. Find it under Settings, Privacy, search, and services.
- Safari and Firefox: both use Safe Browsing style blocklists to warn about dangerous downloads. Keep the browser updated so the lists stay current.
Step 3: Scan the file on your computer before opening it
Downloading a file is not the same as running it. Until you double click it, you can still check it safely.
On Windows 11 and Windows 10
- Open your Downloads folder in File Explorer.
- Right click the file. On Windows 11, choose Show more options if you do not see the scan entry right away.
- Click Scan with Microsoft Defender. The Windows Security app opens and shows the result within seconds.
To scan a whole folder or USB drive, open Windows Security, go to Virus and threat protection, click Scan options, choose Custom scan and pick the location. Microsoft Defender is built into Windows and is enough protection for most home users, as long as it stays updated.
On a Mac
macOS checks apps automatically. Gatekeeper verifies that downloaded apps come from identified developers and have been notarized by Apple, and XProtect scans files for known malware signatures in the background. If macOS says an app cannot be opened because it cannot check it for malicious software, take that warning seriously and only override it for software you trust completely.
Step 4: Upload suspicious files to a free online scanner
When a file still feels off, a second opinion from many engines at once is the best free check available. These services are well known and free for personal use:
| Scanner | What it checks | Good to know |
|---|---|---|
| VirusTotal | Files, links, domains and file hashes against dozens of engines | Files up to 650 MB; uploads become visible to security researchers |
| MetaDefender Cloud | Files, links and hashes with multiple engines from OPSWAT | Free account unlocks more scans |
| Hybrid Analysis | Runs the file in a sandbox and reports its behavior | More technical, best for programs and scripts |
To use any of them, open the site, choose the file tab, select the file from your Downloads folder and wait for the report. Look at how many engines flag it and what they call it. One obscure engine marking a popular installer as suspicious is often a false positive. Five or more engines naming a trojan or ransomware family is not.
openssl sha256 followed by the file path.Signs a download is not worth the risk
- A document or video that turns out to be an .exe, .scr, .js or .vbs file.
- A double extension such as invoice.pdf.exe.
- A zip file protected with a password that was sent in the same email.
- Cracked software, key generators and game cheats, which are a favorite delivery method for password stealers.
- Office files that ask you to enable macros or editing before you can see the content.
FAQ
Can I scan a file without downloading it?
Yes, partly. Pasting the download link into the URL tab of VirusTotal or MetaDefender Cloud checks the address against known threats. For a full verdict on the file itself you still need to download it and upload it or scan it locally.
Is Microsoft Defender good enough on its own?
For most people, yes. It is built into Windows, updates automatically and blocks known malware well. Online scanners are a useful second opinion for files you are unsure about.
Does a clean scan mean a file is 100 percent safe?
No. Brand new malware can slip past every engine for a while. A clean result lowers the risk, but downloading only from official sources is still the best protection.
Do I need to scan files on a Mac?
macOS scans apps automatically with XProtect and Gatekeeper. An online scanner is still worth using for unusual installers or files from people you do not know.
The verdict
Check the link first, keep your browser protection and Microsoft Defender or macOS security switched on, scan the file before you open it and upload anything doubtful to VirusTotal or MetaDefender Cloud. Those four habits take a minute and stop the vast majority of malicious downloads before they ever run.
Updated October 2026: rewritten with current steps for browser download protection, Microsoft Defender, macOS and free online file scanners.
Featured photo: FlyD on Unsplash.
About this article: GeekBlog covers U.S. technology news, AI, phones, smartwatches and gaming. Every story is written and checked under our Editorial Policy. Spotted a mistake or have a story tip? Contact our editors.
