{md5}: Lookup file by MD5 hash

API: circl.lu:hashlookup-circl-api
Endpoint: /lookup/md5/{md5}
Response format: application/json
Auth: none
Method: GET
Last Status: 200
Latency: 164ms

Description

Returns comprehensive file metadata including filename, size, package associations, and parent containers if the MD5 hash exists in the database. Use this to identify files by their MD5 hash and find which software packages contain them.

From spec: Lookup a file by its MD5 hash. Returns file metadata including name, size, associated packages, and parent containers if the hash is found in the database.

Usage Tips

- Input must be a valid 32-character hexadecimal MD5 hash - Case-insensitive: 'abc' and 'ABC' are equivalent - Returns 200 OK with 'hashlookup:trust' field even for unknown hashes (check parents array) - Rate limit: Be respectful of the public service

Parameters (1)

md5 (string, path, required)

MD5 hash in hexadecimal format (32 characters)

Constraints: {'pattern': '^[a-fA-F0-9]{32}$'}

Examples (1)

Lookup MD5 hash for password test file probe-gate

Demonstrates looking up a file by its MD5 hash (commonly used for 'password' string test file)

curl 'https://hashlookup.circl.lu/lookup/md5/5f4dcc3b5aa765d61d8327deb882cf99'

import requests

resp = requests.get("https://hashlookup.circl.lu/lookup/md5/5f4dcc3b5aa765d61d8327deb882cf99")
data = resp.json()

import zingu_apis

api = zingu_apis.api("circl")
result = api.fetch("lookup/md5/{md5}")

for item in result:
    print(item)

const resp = await fetch("https://hashlookup.circl.lu/lookup/md5/5f4dcc3b5aa765d61d8327deb882cf99");
const data = await resp.json();

Truncate

Auto Table Raw

Probe History

Latency

Status Codes

Time	Status	Latency
2026-04-16 01:23:56.429171	200	164ms
2026-04-15 02:58:16.566754	200	167ms
2026-04-14 01:16:04.605351	200	144ms
2026-04-12 13:36:01.061282	200	121ms
2026-04-10 04:17:11.739725	200	134ms
2026-04-09 02:37:57.792202	200	128ms
2026-04-08 06:52:42.670793	200	174ms
2026-04-07 00:35:05.016008	200	561ms