Circl Lu hashlookup CIRCL API
✓ Official Vendor SpecSecurityThreat Detectionnone11 EndpointsREST
For Agents
Look up file hashes (MD5, SHA-1, SHA-256) against the CIRCL hashlookup known-files database to identify known-good or known-bad files during DFIR and malware triage. Supports single and bulk lookups across 11 endpoints.
Use for: I need to check whether an MD5 hash matches a known file, Look up a SHA-256 hash from a malware sample, Submit a batch of SHA-1 hashes for bulk hashlookup, Find the parent files of a given SHA-1 in CIRCL hashlookup
Not supported: Does not handle malware sandboxing, file submission, or live network IOC feeds — use for known-files hash lookup against the CIRCL dataset only.
CIRCL hashlookup is a free, public threat-intelligence service from the Computer Incident Response Center Luxembourg that lets investigators check file hashes against a known-files database covering NSRL, manufacturer software releases, and other curated datasets. The API exposes 11 endpoints over https://hashlookup.circl.lu, supporting MD5, SHA-1, and SHA-256 lookups, bulk lookups for batches, and parent or child relationship traversal between related files. It is widely used in DFIR, malware triage, and software supply-chain checks to quickly separate known-good files from candidates that warrant deeper analysis. The service is open and licensed CC-BY, with optional session keys to retain context across queries.
Install Jentic One Beta
Connect the hashlookup CIRCL API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the hashlookup CIRCL API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with hashlookup CIRCL API.
Look up an MD5 hash to determine whether a file is in the known-files dataset
Look up an SHA-1 or SHA-256 hash for forensic triage of recovered files
Submit a JSON array of MD5 or SHA-1 hashes for bulk lookup in a single request
Walk parent and child relationships between related files using paginated SHA-1 traversal
Create a named session to retain hash-lookup context across multiple queries
Retrieve current database statistics and the top 100 most-queried hashes
Pull general info about the hashlookup database to confirm dataset coverage before triage
Use Cases
Patterns agents use hashlookup CIRCL API for, with concrete tasks.
★ DFIR Triage of a Forensic Image
During digital forensics and incident response, investigators commonly need to filter out known-good operating-system and application files so they can focus on suspicious binaries. CIRCL hashlookup accepts MD5, SHA-1, or SHA-256 lookups against datasets that include NSRL, allowing a triage script to run thousands of file hashes from an evidence image and quickly separate known files from unknowns. Bulk endpoints reduce round-trips and finish a typical workstation triage in minutes.
POST a JSON body with a hashes array of 500 MD5 values to /bulk/md5 and return the list that matched the CIRCL dataset.
Malware Sample Pre-Check
Before submitting a suspected sample to a sandbox, an analyst can call /lookup/sha256/{sha256} to check whether CIRCL already recognises the hash as a known-good file from a manufacturer release. This shortcuts false positives on legitimate signed binaries — a common situation when EDR alerts on a hash that matches a known build artifact.
GET /lookup/sha256/e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 and return whether the file is in the known-files dataset.
Software Supply-Chain Verification
Build pipelines and software bill-of-materials tooling can use the parent and child traversal endpoints to verify that an artefact's hash maps to a known component family. /parents and /children take a SHA-1, count, and cursor, returning paginated relationship data so a CI job can confirm an installer or library belongs to an expected upstream package set.
GET /parents/{sha1}/100/0 for sha1=da39a3ee5e6b4b0d3255bfef95601890afd80709 and list the parent file hashes returned.
AI Agent SOC Assist
An AI agent invoked through Jentic can take a list of file hashes flagged by an EDR alert, query CIRCL hashlookup, and return a summary of which are known-good versus unknown — without holding any credentials, since CIRCL hashlookup is unauthenticated. Jentic standardises the call shape so the agent does not need to learn the URL pattern for each hash type.
Search Jentic for 'lookup file hash in CIRCL hashlookup', load the GET /lookup/sha1/{sha1} schema, and call it for each SHA-1 from the alert payload.
Key Endpoints
11 endpoints — circl hashlookup is a free, public threat-intelligence service from the computer incident response center luxembourg that lets investigators check file hashes against a known-files database covering nsrl, manufacturer software releases, and other curated datasets.
METHOD
PATH
DESCRIPTION
GET
/lookup/md5/{md5}
Look up a single MD5 hash
GET
/lookup/sha1/{sha1}
Look up a single SHA-1 hash
GET
/lookup/sha256/{sha256}
Look up a single SHA-256 hash
POST
/bulk/md5
Bulk lookup an array of MD5 hashes
POST
/bulk/sha1
Bulk lookup an array of SHA-1 hashes
GET
/parents/{sha1}/{count}/{cursor}
Paginated parents of a SHA-1
GET
/info
Database info and dataset coverage
GET
/lookup/md5/{md5}
Look up a single MD5 hash
GET
/lookup/sha1/{sha1}
Look up a single SHA-1 hash
GET
/lookup/sha256/{sha256}
Look up a single SHA-256 hash
POST
/bulk/md5
Bulk lookup an array of MD5 hashes
POST
/bulk/sha1
Bulk lookup an array of SHA-1 hashes
GET
/parents/{sha1}/{count}/{cursor}
Paginated parents of a SHA-1
GET
/info
Database info and dataset coverage
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
CIRCL hashlookup is unauthenticated, so there are no credentials to manage. Jentic still routes the request through MAXsystem so the agent's egress IP and rate-limit budget are isolated from other tenants.
Intent-based discovery
Agents search Jentic by intent (e.g., 'check whether an MD5 hash is known') and Jentic returns the matching CIRCL hashlookup operation with its parameter schema, removing the need to memorise the per-hash-type URL pattern.
Time to first call
Direct CIRCL integration: a few hours to wire HTTP, error handling, and bulk batching. Through Jentic: under 15 minutes — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using hashlookup CIRCL API through Jentic.
What authentication does the CIRCL hashlookup API use?
CIRCL hashlookup is a free public service and does not require authentication — there is no API key. Through Jentic, you can call it without configuring any credential and Jentic will execute the request directly against https://hashlookup.circl.lu.
Can I look up SHA-256 hashes with the CIRCL hashlookup API?
Yes. GET /lookup/sha256/{sha256} returns dataset metadata for a single SHA-256 hash. The API also supports MD5 via /lookup/md5/{md5} and SHA-1 via /lookup/sha1/{sha1}, with bulk equivalents for MD5 and SHA-1.
What are the rate limits for CIRCL hashlookup?
CIRCL does not publish hard rate limits in the OpenAPI spec, but the service is community-funded, so respect fair-use guidance on the project page and prefer the bulk endpoints for batches. Jentic surfaces 429 responses transparently if throttling is applied.
How do I bulk-check a list of MD5 hashes through Jentic?
Run pip install jentic, then search Jentic for 'bulk hash lookup CIRCL'. Jentic returns the POST /bulk/md5 operation. Load the schema, supply a JSON body with a 'hashes' array of MD5 strings, and execute. Sign up at https://app.jentic.com/sign-up.
What datasets does CIRCL hashlookup cover?
The dataset includes NSRL (NIST National Software Reference Library), manufacturer software releases, and other curated known-files sources. Call GET /info to retrieve current dataset metadata and coverage. Combined with /stats/top this lets you confirm freshness before relying on results for triage.
Can I traverse relationships between known files?
Yes. GET /parents/{sha1}/{count}/{cursor} and GET /children/{sha1}/{count}/{cursor} return paginated parent and child SHA-1 hashes for a given file, useful for mapping installer to component relationships in supply-chain verification.
GET STARTED