Identify which ransomware encrypted your files – in seconds.
ID Ransomware is a free website that helps victims determine which ransomware affected their computer. It recognizes over 600+ families by file extensions and patterns, ransom note names, known hex signatures, email and Bitcoin addresses. If identified, it shows whether decryption is known and links to a credible source for next steps.
Note: this page is unofficial, an independent showcase. The service is available on the external site above.
What can ID Ransomware do?
600+ families
Detection by extension and pattern.
Clear status
Is decryption known? Linked knowledge base.
Safe
Only sample files/notes. No installation.
Fast
Preliminary ID in seconds.
Main features
Smart identification
Filename patterns (e.g., *.locked), ransom note names, hex signatures and addresses.
Transparent results
Shows matching families and confidence level for each sample.
Trusted sources
Links to reputable write‑ups and—if available—decryptor tools.
How it works
Collect samples
Select 1–2 small encrypted files and the ransom note (if present).
Upload to IDR
Visit the ID Ransomware website and upload your samples. No sensitive data required.
Result & next steps
It indicates if a decryptor is known. Follow the trusted source instructions.
Safety measures
Make backups, avoid paying immediately, and seek expert help for recovery.
Tip: use Ctrl + L to jump to the address bar quickly.
Try ID Ransomware now
Free identification, clear status, trusted sources. One click away:
Go to ID RansomwareFAQ
Is this page affiliated with the ID Ransomware operators?
No. This is an independent, informational promo page that links to the official service.
Is it safe to upload samples?
Only use small files that contain no sensitive data. Do not upload personal or confidential information.
Is decryption guaranteed?
No. The site indicates if a known decryptor exists, but that is not available for every variant.