The safest way to scan a file for malware before you open it is to upload it (or its SHA-256 hash) to VirusTotal, which checks it against 70+ antivirus engines at once, and to run a quick right-click scan with the security software already built into your device. If a file looks even slightly suspicious, open it inside a sandbox instead of on your real system.
Email attachments, “cracked” software, and random downloads are still the top ways malware lands on personal computers in 2026, but you no longer need to be a security professional to vet a file. A handful of free tools will tell you whether something is dangerous in under a minute. Here is how to do it, starting with the fastest, most reliable method and working through built-in antivirus, hash checks, sandboxing, and the warning signs that should stop you before you even scan.
Method 1: Scan with VirusTotal (the fastest second opinion)
VirusTotal is a free, Google-owned service that runs a single file past dozens of antivirus engines simultaneously. Because no single antivirus catches everything, this “wisdom of the crowd” approach is the closest thing to a definitive verdict that a regular user can get for free. If 40 engines flag your file, you have your answer. If zero do, that is reassuring, though not an absolute guarantee.
- Go to virustotal.com. You do not need an account to scan a file.
- Click the “File” tab and drag your file into the box, or browse to it. The upload limit is 650 MB. VirusTotal actually recommends against scanning files larger than that, since huge files are usually bundles, and it is better to extract and scan the individual files inside.
- Wait for the analysis. VirusTotal runs the file through 70+ engines and shows a detection ratio, for example “3 / 72 security vendors flagged this file.”
- Read the results carefully. A handful of detections labeled “generic,” “heuristic,” or “PUP” (potentially unwanted program) can be false positives, common with game mods, keygens, and installer wrappers. Multiple engines naming a specific malware family (a trojan, ransomware, or stealer) is a strong danger signal.
- Check the extra tabs. The “Details” tab shows the file’s hashes and type; “Behavior” shows what the file does when detonated; and “Community” shows notes from other users. These add valuable context beyond the raw score.
Important privacy note: Anything you upload to VirusTotal can be downloaded and inspected by other users who pay for VirusTotal’s threat-intelligence access. Treat every upload as public. Never upload files that contain personal or confidential data, such as tax documents, medical records, contracts, or anything with passwords inside. If privacy matters, use the hash method below instead.
Method 2: Look up the file’s hash instead of uploading it
A file’s hash is a unique fingerprint, a long string of characters calculated from the file’s exact contents. If even one byte changes, the hash changes completely. VirusTotal lets you search by hash, so if the file has been seen before, you get a verdict without uploading a single byte of your (possibly sensitive) file.
How to get a file’s SHA-256 hash
On Windows, open PowerShell, type Get-FileHash "C:pathtofile.exe", and press Enter. It returns the SHA-256 hash by default.
On macOS, open Terminal and run shasum -a 256 /path/to/file.
Copy the resulting hash, go to VirusTotal, click the “Search” tab, paste it in, and hit Enter. If VirusTotal has seen that exact file before, you will see the full report instantly. If it returns “not found,” the file is either brand new or has been altered, in which case you fall back to uploading it or sandboxing it. Hash lookups are also the privacy-safe way to check confidential files, since you never expose the contents.
Method 3: Use the antivirus you already have
Before reaching for anything online, use the protection built into your device. It works offline, keeps the file private, and takes seconds.
Windows: right-click scan with Microsoft Defender
Every modern Windows 10 and Windows 11 machine ships with Microsoft Defender Antivirus turned on by default. To scan a single file or folder, right-click it in File Explorer and choose Scan with Microsoft Defender. (On Windows 11, you may need to click “Show more options” first to see it.) The results open in the Windows Security app, telling you whether threats were found. Defender also scans most downloads automatically, but a manual right-click scan is a smart extra step for anything you did not expect.
Windows adds a second layer called SmartScreen. Rather than scanning file contents, SmartScreen checks a program’s reputation. If you try to run a downloaded app that few people have run before, you will see a blue “Windows protected your PC” warning. That is not proof the file is malware, but on an unknown installer it is a strong hint to stop and verify before clicking “Run anyway.”
macOS: built-in protections and manual scans
Macs include layered defenses that run quietly: Gatekeeper blocks apps that are not signed or notarized by Apple, and XProtect scans for known malware signatures in the background. If you download an app and macOS refuses to open it, that is Gatekeeper doing its job, so do not blindly override it. macOS has no built-in right-click “scan this file” button, so for an on-demand check use VirusTotal or install a reputable free scanner such as Malwarebytes for Mac.
Method 4: Detonate suspicious files in a sandbox
Scanning tells you whether a file matches known malware. A sandbox tells you what the file actually does by running it in an isolated, disposable environment where it cannot touch your real computer. This is the gold standard for a file that scans clean but still feels wrong, or a brand-new file no engine has seen.
Windows Sandbox is a free, throwaway Windows desktop built into Windows 10 and 11 Pro and Enterprise editions. Enable it under “Turn Windows features on or off,” launch it, and copy your suspect file inside. Anything the file does stays in the sandbox and is wiped the moment you close it. Note that it is not available on Windows Home editions.
Online sandboxes do the same work in your browser, with the same public-file caveat as VirusTotal:
- Any.Run is interactive, meaning you can click through installers and prompts and watch what happens in real time. The community tier is free for non-commercial use.
- Hybrid Analysis (by CrowdStrike) gives a detailed automated behavior report, including network connections and files created.
- Joe Sandbox offers deep automated analysis and a free “Cloud Basic” tier for public submissions.
As with VirusTotal, files you submit to free online sandboxes may be visible to other users, so never detonate anything containing private data.
Method 5: Let your email and cloud storage scan for you
If the file arrived as an attachment, some of the work is already done. Gmail automatically scans attachments up to about 25 MB for viruses and blocks known-dangerous file types outright. Google Drive scans files up to 100 MB and warns you before downloading anything flagged. Microsoft Outlook and OneDrive perform similar scanning. These filters are a useful first pass, but they are not comprehensive, so do not treat “Gmail let it through” as a clean bill of health for an unexpected attachment. Scan it yourself before opening.
Method 6: Checking files on your phone
Mobile malware is real, though the platforms are more locked down. On Android, Google Play Protect scans apps automatically, and you can open the Play Store, tap your profile icon, and run a manual scan. Sideloaded APK files from outside the Play Store are the biggest risk, so avoid them; if you must check one, upload it to VirusTotal from your phone’s browser. On iPhone and iPad, Apple’s sandboxed app model and App Store review make traditional file-scanning apps largely unnecessary and, in fact, impossible to build. The real iOS threats are phishing links and malicious configuration profiles, not downloaded files, so focus your caution there.
Comparing the main scanning methods
| Method | What it catches | Best for | Privacy note |
|---|---|---|---|
| VirusTotal (upload) | Known malware across 70+ engines | A fast, thorough second opinion | Uploads are public; never send private files |
| VirusTotal (hash search) | Known malware, if the file was seen before | Checking sensitive files privately | Private; the file itself never leaves your device |
| Microsoft Defender (right-click) | Known malware, one engine, offline | A quick everyday first check on Windows | Fully private; nothing is uploaded |
| Windows SmartScreen | Low-reputation and unknown programs | Catching unusual downloaded apps | Sends reputation data to Microsoft |
| Sandbox (Windows Sandbox / Any.Run) | Behavior of new or unknown files | Files that scan clean but feel wrong | Local sandbox is private; online ones are public |
Warning signs to spot before you scan
Scanning is your safety net, not your first line of defense. Many dangerous files give themselves away if you know what to look for:
- Double extensions. A file named
invoice.pdf.exeorphoto.jpg.scris disguising an executable as a document. Windows hides known extensions by default, so turn on “File name extensions” in File Explorer’s View menu to see the real ending. - Risky file types. Be especially wary of
.exe,.scr,.bat,.cmd,.js,.vbs,.msi, and archives (.zip,.rar,.7z,.iso) that arrive unexpectedly. Even Office files (.docm,.xlsm) can carry malicious macros. - Unzip before you scan, carefully. Antivirus can look inside archives, but attackers sometimes password-protect a ZIP specifically to hide its contents from scanners. If an email supplies a password to open the attachment, that is a major red flag. Extract archives from unknown sources only inside a sandbox.
- Pressure and surprise. “Enable content,” “Your invoice is overdue,” or a file you did not request are classic lures. Urgency is a manipulation tactic, not a reason to hurry.
- Mismatched icons. A file with a Word or PDF icon that is actually an
.exeis trying to trick you. Always confirm the true file type before double-clicking.
Putting it all together
For everyday files, a quick right-click scan with Microsoft Defender plus a VirusTotal check covers you in well under a minute, and the hash-lookup trick keeps sensitive documents private while still getting you a verdict. When a file is unexpected, high-stakes, or simply gives you a bad feeling, do not gamble on your main computer; open it in Windows Sandbox or an online sandbox and watch what it does first. No single tool is perfect, which is exactly why layering them works: an engine that misses a threat is usually backed up by another that catches it, and a sandbox reveals bad behavior that signatures alone would miss. Build the habit of scanning before you open, and you close off one of the most common ways malware reaches a personal device.
