VirusTotal is a cloud service for looking up and analyzing files, URLs, domains, and IP addresses with signals from many security products and analysis tools. Its greatest strength is shared reputation context. Its most important limitation is the same sharing model: a standard submission contributes information to a corpus used by the security community and VirusTotal partners.
This review checks VirusTotal’s current documentation as of August 30, 2026. Top5soft did not upload malware, benchmark antivirus engines, license VirusTotal Enterprise, or measure scan times for this edition.
Correction published August 30, 2026: The previous edition mixed up standard submissions, the public and premium APIs, VirusTotal Intelligence, and Private Scanning. It also published contradictory quotas and file-size limits, invented prices and performance figures, overstated zero-day limitations, and used generated interface images. This edition removes those claims and explains the documented workflows separately.
What VirusTotal is
VirusTotal is an information aggregator, not a single antivirus engine. Its official workflow description says the service inspects items with more than 70 antivirus scanners and URL or domain blocklisting services, alongside tools that extract static, behavioral, community, and relationship signals.
The service accepts files and URLs through its website and APIs. Search also covers existing file reports by MD5, SHA-1, or SHA-256 hash, as well as URL, domain, and IP information. This makes VirusTotal useful for answering a narrow first question: has the observable already been seen, and what context has contributors attached to it?
VirusTotal does not issue one authoritative clean-or-malicious verdict. It displays the outputs of contributors and its analysis systems. The company explicitly says false positives must be corrected by the vendor that produced the detection. A report therefore supports investigation; it does not replace an endpoint security product, sandbox procedure, or analyst decision.
Start with a hash search
The lowest-disclosure workflow is to calculate a file’s cryptographic hash locally and search for that hash before uploading the file. VirusTotal’s search documentation says an existing report can be retrieved by MD5, SHA-1, or SHA-256 without resubmitting the item.
A hash lookup sends the identifier, not the file contents. If the exact file is already in the corpus, the existing report may provide useful reputation, names, dates, signatures, relationships, comments, and behavioral context. If no report exists, the absence says only that the hash is not available through that search. It is not evidence that the file is safe.
Hash matching is exact. Repacking an archive, changing a document, or rebuilding an executable changes its cryptographic hash. Analysts should also confirm that the hash was calculated from the intended file and should not treat a familiar filename as identity evidence.
For confidential, regulated, proprietary, or personal material, stop before a standard upload unless the organization has explicitly approved VirusTotal’s sharing model. Redacting a document may change the file being investigated and can remove the content that made it suspicious, so it is not a universal substitute for an approved private workflow.
What happens in a standard submission
VirusTotal is built around collective threat-intelligence sharing. Its documentation says basic results are shared with the submitter and examining partners. Scan reports are shared with the public VirusTotal community, and the contents of submitted files or pages may be shared with premium VirusTotal customers.
That model helps security vendors study emerging threats and improve detections. It also means the familiar standard upload form is inappropriate for a confidential contract, unreleased software build, customer export, internal incident artifact, or document containing personal data unless policy and authorization clearly permit that contribution.
Do not assume that creating an account, using an API key, or buying an unrelated VirusTotal product automatically makes an ordinary submission private. Privacy depends on using the specifically licensed Private Scanning workflow. The standard corpus and Private Scanning are distinct services with different reports.
VirusTotal describes its free service as intended for non-commercial use under its terms. Teams planning a commercial integration or operational security workflow should discuss the use case and required licensing with VirusTotal instead of stretching a personal public API key beyond its permitted purpose.
How to interpret a report
Begin with file identity: hash, type, size, signing information, and known names. Then review which engines produced a detection, the labels they used, when the item was last analyzed, and whether static or behavioral details support the same conclusion.
A single detection can be a false positive, especially when stronger identity and provenance evidence supports legitimate software. A large number of detections can increase concern, but the engines are not statistically independent votes and the raw count is not a probability that a file is malicious. VirusTotal itself warns that its platform is not designed for comparative antivirus testing because contributors use different products, configurations, and heuristics.
A zero-detection report is also not a safety certificate. Contributors may not yet recognize a new threat, a payload may be encrypted or staged elsewhere, and some behavior appears only under particular conditions. Conversely, a sandbox or community flag still needs context and can be wrong.
Useful corroboration includes a valid publisher signature, a hash published over a separate trusted channel, consistent prevalence and first-seen data, sensible parent or child relationships, behavior that matches the software’s purpose, and independent endpoint or sandbox evidence. Treat community comments and linked resources as untrusted research leads, not instructions to open or execute content.
Private Scanning is a different product
VirusTotal’s licensed Private Scanning workflow keeps submitted files and URLs inside VirusTotal infrastructure, does not share them with third parties, and limits reports to the submitting organization. The documentation says files and reports are deleted after their retention period, usually 24 hours by default, with organization preferences able to change that value.
The privacy benefit changes the analysis. Private reports do not contain the familiar multi-antivirus or URL-scanner partner verdicts. They can include VirusTotal’s static tooling, sandbox output, network analysis, similarity, rules, and threat-intelligence enrichment. Private Scanning is therefore not merely a hidden copy of a standard public report.
Administrators can choose settings such as retention, storage region, sandbox network behavior, and live interaction where supported. Those controls should be reviewed against organizational policy before use. The file still leaves the local device and is processed on VirusTotal infrastructure; “private” here does not mean local or offline.
If a private analysis finds a malicious sample, VirusTotal encourages customers to contribute it to the standard corpus when sharing is appropriate. That later contribution is a separate decision and should follow incident-response, legal, and data-handling rules.
API, Intelligence, hunting, and pricing
VirusTotal’s API v3 can retrieve reports, submit files and URLs, and automate permitted workflows. The official public-versus-premium documentation lists the public API at 4 requests per minute and 500 per day. It also states that the public API must not be used in commercial products, services, or business workflows. Current quota details should always be checked in the account and contract because entitlements can differ.
Larger API uploads use an upload-URL endpoint rather than the basic file endpoint. File-size handling, rate limits, searchable data, downloads, and sandbox access depend on endpoint and license, so one universal “free versus premium” table would be misleading.
VirusTotal Intelligence provides richer corpus search and investigation capabilities. VT Hunting applies YARA through Livehunt for incoming samples and Retrohunt for historical data; VTDIFF assists with rule creation. Private Scanning addresses restricted submissions. Premium API access addresses commercial automation and additional data. These products can be licensed together, but they solve different problems.
VirusTotal publishes quote-based rather than dependable public list pricing for the professional services relevant here. This review does not repeat reseller estimates or invented annual prices. Buyers should request a quote tied to users, API volume, Intelligence searches, hunting, downloads, Private Scanning, regions, retention, and support requirements.
Strengths and limitations
Documented strengths
- More than 70 antivirus and URL or domain contributors plus additional analysis tools.
- Free hash search can retrieve an existing report without uploading the file again.
- Detailed contributor labels, metadata, relationships, comments, and analysis context.
- Public APIs for permitted non-commercial automation and licensed APIs for professional use.
- Intelligence, Graph, Livehunt, Retrohunt, and similarity workflows for threat researchers.
- A separate Private Scanning service for samples that cannot enter the shared corpus.
Important limitations
- Standard reports and submissions participate in a sharing ecosystem.
- Private Scanning omits partner antivirus verdicts.
- Contributor detections can be false positives, and VirusTotal cannot correct a vendor’s label.
- A clean-looking report does not prove that a file or URL is safe.
- Detection counts are not valid antivirus rankings or probability scores.
- Public API terms and limits do not fit commercial production workflows.
- Professional products use account-specific licensing and quote-based pricing.
- The amount and type of analysis vary by file, observable, endpoint, and entitlement.
Alternatives and complementary tools
The source-verified file scanner guide separates reputation lookup, behavior analysis, cloud multiscanning, and local document sanitization.
ANY.RUN provides an interactive sandbox where an analyst can operate the remote system and inspect behavior. Community analyses are public, while private work requires an appropriate plan.
Hybrid Analysis focuses on automated static and dynamic malware analysis backed by Falcon Sandbox. Public submissions should not contain confidential material.
MetaDefender Cloud combines multiscanning with technologies such as Deep CDR, vulnerability checks, and APIs. Its privacy and sharing behavior depend on the selected service and license.
OPSWAT File Security for Browser brings MetaDefender checks into Chrome and Edge download workflows, but cloud analysis can still upload the complete file.
Dangerzone converts supported documents locally into reconstructed PDFs. It is useful when the goal is safer reading rather than malware-family identification or shared reputation.
Verdict
VirusTotal is an excellent first stop for reputation context when the analyst understands what is being disclosed. Searching a SHA-256 hash before uploading is the best default habit: an existing report may answer the question without contributing another copy of the file.
The standard service is a poor destination for confidential material because sharing is part of its purpose. Licensed Private Scanning solves a different problem, but its reports omit partner antivirus verdicts and its files still run on VirusTotal infrastructure for a configured retention period.
Use the report as evidence, not a verdict. Check identity, provenance, individual labels, static and behavioral context, dates, relationships, and trusted corroboration. Escalate uncertain or high-impact cases to an approved sandbox and a trained analyst.
Best fit: hash and URL reputation checks, malware-research context, false-positive investigation, and licensed threat-intelligence workflows.
Poor fit: confidential standard uploads, standalone endpoint protection, antivirus product comparisons, or any decision based only on the detection count.
Frequently asked questions
Is VirusTotal free?
The standard service and a limited public API are available free for permitted non-commercial use. Intelligence, premium API access, and Private Scanning require professional licensing; current pricing is quote-based.
Does VirusTotal share uploaded files?
For standard submissions, reports are shared with the public community and file or page contents may be shared with premium customers. Use the specifically licensed Private Scanning workflow when an approved sample must remain within the organization and VirusTotal infrastructure.
Can I check a file without uploading it?
Yes, if you calculate its MD5, SHA-1, or preferably SHA-256 hash locally and VirusTotal already has a report for that exact hash. A missing report is not a clean result.
Does zero detections mean a file is safe?
No. A report reflects the signals available at that time and under those analysis conditions. New, encrypted, staged, or environment-sensitive threats can evade those signals.
Is Private Scanning the same report with hidden visibility?
No. Private Scanning keeps the submission and report within the organization for a retention period, but it does not include the partner antivirus verdicts shown in standard VirusTotal reports.
