Is It Safe to Upload Files to VirusTotal?

It's safe for a random download or a suspicious email attachment you don't own. It isn't safe for anything confidential: a contract, a payslip, an internal spreadsheet, a client's files. VirusTotal's terms say an uploaded file is shared with its antivirus and security partners, and its paid tiers can download submitted files. The safer habit is to search by the file's hash first, which tells VirusTotal nothing about the contents. Below is what happens to each kind of submission, how to get a hash on any computer, and what to do if you've already uploaded something private.

What happens to a file after you upload it?

VirusTotal runs the file through dozens of antivirus engines and other scanners, then keeps it. That's the whole point of the service: it's a shared threat library, and every upload adds to it. The terms that VirusTotal published for years (dated January 27, 2021, and now archived on its docs site as the "historic" terms, after the service moved under Google Cloud's security terms) are blunt about it. A submitted sample "is immediately shared for review by the Service's Partners," and users agree to "only upload samples that you wish to publicly share."

The same terms ask you not to knowingly submit files containing "confidential or commercially sensitive data or personal data of any individual" without permission. In other words, VirusTotal itself tells you not to upload private documents. The API documentation also lists a "Download a file" endpoint for paid customers, so a file you upload can end up on a security analyst's machine at a company you've never heard of.

None of that is sinister. Malware researchers need real samples. It just means the upload button is a publish button, not a private scan.

What does each kind of check share?

URL scans catch people out. A password-reset link, a shared-document link or a link with a login token in it is effectively a key. Scanning it hands that key to a public database. Strip anything after the ? before you scan, or don't scan links that came to you personally.

How do I check a file without uploading it?

Search for its hash. A SHA-256 hash is a fixed-length fingerprint of the file's exact bytes, and VirusTotal's search box accepts one directly. If anyone has uploaded the same file before, you'll see the full report without sending anything. If the hash is unknown, you've learned something too: the file is either new, rare or unique to you.

Every major operating system can make the hash for you, no install needed:

For text files such as scripts, config files or a pasted snippet, our Hash Generator works too, and it runs in your browser. Be aware that it reads files as text, so for programs, archives, PDFs and Office files the command line is the reliable route. A hash computed from the wrong bytes won't match anything.

The free public API follows the same idea. It only allows searching by hash, at four requests a minute, and it's for non-commercial use.

Which files should never go to VirusTotal?

A simple test: would you be fine emailing this file to a stranger at an antivirus company? If not, don't upload it. That rules out:

• Contracts, invoices, tax forms and anything with account numbers
• Resumes, medical letters, ID scans and anything with someone else's personal data
• Internal company documents, source code and builds that aren't public yet
• Files a client sent you. It isn't your data to share
• Password-protected archives with private contents (the password protects the contents, but the file and its name still go into the corpus)

Office documents and PDFs also carry metadata that says more than you'd expect: author names, company names, edit history, sometimes file paths from your computer. If you have to share a document with anyone outside, run it through the Document Metadata Remover first. For photos, the Image Metadata Remover strips GPS and camera data. Both work on your device.

What if a private file looks suspicious?

Hash search first. If that finds a known-malicious match, you have your answer. If it finds nothing, you've got a few choices that don't involve publishing the file:

• Scan it locally with the antivirus already on your machine. Microsoft Defender has a right-click scan option in Windows
• Check whether your antivirus is set to send samples to its vendor automatically. In Windows Security that's the "Automatic sample submission" setting, and you can switch it to ask first
• Ask whoever sent it to confirm through a different channel, like a phone call
• At work, hand it to IT. If your company has VirusTotal's paid Private Scanning, files submitted there stay inside your organization and are deleted after the retention period. Note that private scans don't include the antivirus verdicts that make the public service useful

I already uploaded something private. Now what?

Assume the file has been shared and act on what's inside it. VirusTotal's archived terms say contributed samples "generally will not be removed" unless they're illegal or violate someone's rights, so deletion isn't something you can count on. You can still contact VirusTotal and ask, especially for personal data, where privacy laws may give you a right to request removal.

Then deal with the exposure itself. Change any passwords or keys in the file. Tell your employer or client if their data was in it. If it held someone's personal information, check whether your organization has a breach-reporting duty. For the broader question of handing documents to online tools, our guide on whether it's safe to upload PDFs online covers the same reasoning for converters and editors.

The bottom line

VirusTotal is a great tool used the right way. Search by hash for anything private, upload only files you didn't create and wouldn't mind being public, and clean the query string off links before scanning them. For more tools that keep files on your own device, see the best free privacy tools.

Frequently Asked Questions

Related Tools