PAGES
← all tools
◆ Malware Analysis

ssdeep

release-1.1 open-source

ssdeep is a fuzzy hashing tool that computes context-triggered piecewise hashes to identify similar or partially matching files, useful in malware analysis.

source ↗ rss ↗ What is a cyber toolchain?

Summary

ssdeep is an open-source, free command-line tool that computes context-triggered piecewise hashes, letting an analyst compare files for partial or fuzzy similarity rather than exact matches. Run against a batch of files, it outputs a CSV-style list of hash entries with a block size per file, and it will warn when a file is too small to produce a meaningful comparison, which matters for anyone tuning results across mixed file sizes. It fits malware analysis and forensics work, where analysts triage samples or configuration files for near-duplicates rather than relying on cryptographic hashes that break on the smallest change. It sits in the fuzzy-hashing corner of file-analysis tooling, a category rather than a single named rival. First committed in 2008, it still saw 39 commits in the past year from 11 contributors, so it remains maintained rather than abandoned.

ssdeep is a fuzzy hashing tool that computes context-triggered piecewise hashes to identify similar or partially matching files, useful in malware analysis.

How ssdeep helps

Which of these malware samples are variants of something I've already seen?

computes a piecewise hash for each file and compares them for partial similarity, flagging near-matches even when attackers changed sections of the code rather than relying on a cryptographic hash that would show no relationship at all

Did this configuration file get quietly altered from the baseline I have on file?

hashes the current file and the reference copy and reports how closely the piecewise blocks line up, catching partial edits that an exact hash would only report as completely different

Which files in this batch are near-duplicates of each other?

runs the hashing across every file in a directory and outputs a CSV list of hash entries with block sizes, so entries with matching or close hashes can be picked out as related

Can I trust a similarity score between two very small files in this batch?

warns when a file is too small to produce a meaningful comparison, signaling that any close or distant score for that entry may not reflect real similarity

Are my code and config files across this project structurally similar to each other?

produces one hash entry per file with its block size, letting the reader line up entries such as settings and deployment manifests to see which pairs are closest in structure

all 5 features, with the evidence for each →

Languages

Not documented

Features

5 capabilities · 1 backed by code, an API document or a real run

Built from ssdeep's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • ssdeep covers 1 of the 8 investigation and response capabilities we track.

What ssdeep offers you

  • CSV data export1
All capabilities 5 capabilities
Fuzzy hashing of files verified suggested Computes ssdeep fuzzy hashes for files and outputs results as a standard ssdeep 1.1 CSV, with warnings when files are too small to produce fully meaningful results. 15 releases · 7 other sources · first seen Feb 2008

Suggested capability: Threat indicator matching. This is our guess, not confirmed.

Also counts toward: CSV data export

release 15 total

  • Adds verbose output displaying filenames as they are hashed during execution release-1.1 · Jun 2017 · source · release history
  • threshold mode outputs matches above a confidence score instead of just the top match. release-2.0 · Jun 2017 · source · release history
  • Adds support for arbitrary length input from the standard input release-2.13 · Jun 2017 · source · release history
  • Adds -p flag to -d mode for bi-directional matching without self-matches release-1.1 · Jun 2017 · source · release history
  • API functions now return values indicating errors instead of undefined behavior on failure release-2.5 · Jun 2017 · source · release history
  • Increases maximum hashable data on stdin from previous limit to 512MB release-2.9 · Jun 2017 · source · release history

we ran it

  • Produced a valid ssdeep 1.1 CSV header followed by six fuzzy-hash entries covering Dockerfile, requirements.txt, package.json, app/settings.py, app/db.py, and k8s/deployment.yaml, with block sizes… Aug 2026 · the full run
  • The tool produced a valid ssdeep 1.1 hash header followed by six hash entries covering Dockerfile, requirements.txt, package.json, app/settings.py, app/db.py, and k8s/deployment.yaml. Aug 2026 · the full run

example

  • Export hash comparison results to CSV for spreadsheet analysis. ssdeep -c file1.txt file2.txt release-2.0 · Jun 2017 · source
  • Hash a file on Win32 systems using only its filename path without full path issues. fuzzy_hash_filename('/path/to/file.txt') release-2.1 · Jun 2017 · source
  • Find similar files in the current directory using a single command ssdeep -d . release-1.1 · Jun 2017 · source
  • Get bi-directional matches without self-matches and see filenames being processed ssdeep -dp /path/to/directory release-1.1 · Jun 2017 · source
  • Get all file hashes matching a given hash with at least 30% confidence. ssdeep -t 30 target_file.bin release-2.0 · Jun 2017 · source
Programmatic API integration shipped suggested Provides C++ compatibility, a Windows DLL/API for fuzzy hashing, and functions to hash filenames, compare signatures, and retrieve hash set lengths. 3 releases · first seen Jun 2017

Suggested capability: Threat indicator matching. This is our guess, not confirmed.

release

  • Project can be compiled with a C++ compiler (C++ compatibility) release-2.5 · Jun 2017 · source · release history
  • Fuzzy hashing API/DLL is now available for programmatic integration on Windows. release-2.0 · Jun 2017 · source · release history
  • API documentation is added to the release artifacts release-2.5 · Jun 2017 · source · release history
Advanced matching logic shipped Enables comparing two or more files containing signatures against one another and allows threshold-based confidence matching. 2 releases · first seen Jun 2017

Shared capability: Threat indicator matching

release

  • Added capability to compare two or more files containing signatures against one another release-2.2 · Jun 2017 · source · release history
  • threshold mode outputs matches above a confidence score instead of just the top match. release-2.0 · Jun 2017 · source · release history
API reliability shipped API functions return values indicating errors instead of undefined behavior on failure. 1 release · first seen Jun 2017

release

  • API functions now return values indicating errors instead of undefined behavior on failure release-2.5 · Jun 2017 · source · release history
File size support shipped Supports hashing files up to 192GB and handles arbitrary length input from stdin. 1 release · first seen Jun 2017

release

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for ssdeep, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail ssdeep puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

13 entries

  1. June 20179
  11. February 20121
  13. July 20101
  15. February 20082
    Show

    13 entries

    1. release-1.1 Jun 27, 2017 · release notes

      First public release of ssdeep with fuzzy hashing and similarity scanning capabilities

      └──▷ GET THIS VERSION 
      $ git clone --branch release-1.1 https://github.com/ssdeep-project/ssdeep.git
# already have the repo? check out this version:
$ git checkout release-1.1
      └──▷ USE IT
      Find similar files in the current directory using a single command
      shell 
      ssdeep -d .
      Get bi-directional matches without self-matches and see filenames being processed
      shell 
      ssdeep -dp /path/to/directory
      • Adds -d flag to scan a directory tree for similar files in a single pass
      • Adds -p flag to -d mode for bi-directional matching without self-matches
      • Adds verbose output displaying filenames as they are hashed during execution

      3 details in Everything

    2. release-2.0 Jun 27, 2017 · release notes

      ssdeep 2.0 adds fuzzy hashing API/DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls., Unicode filename support on Win32, threshold and CSV modes

      └──▷ GET THIS VERSION 
      $ git clone --branch release-2.0 https://github.com/ssdeep-project/ssdeep.git
# already have the repo? check out this version:
$ git checkout release-2.0
      └──▷ TRY IT
      Get all file hashes matching a given hash with at least 30% confidence.
      $ ssdeep -t 30 target_file.bin
      Export hash comparison results to CSV for spreadsheet analysis.
      $ ssdeep -c file1.txt file2.txt
      • threshold mode outputs matches above a confidence score instead of just the top match.
      • CSV mode emits results in comma-separated values format for easy ingestion.
      • Fuzzy hashing API/DLL is now available for programmatic integration on Windows.

      3 details in Everything

    3. release-2.1 Jun 27, 2017 · release notes

      Adds fuzzy_hash_filename function for Windows file hashing

      └──▷ GET THIS VERSION 
      $ git clone --branch release-2.1 https://github.com/ssdeep-project/ssdeep.git
# already have the repo? check out this version:
$ git checkout release-2.1
      └──▷ USE IT
      Hash a file on Win32 systems using only its filename path without full path issues.
      c 
      fuzzy_hash_filename('/path/to/file.txt')
    4. release-2.2 Jun 27, 2017 · release notes

      ssdeep release-2.2 adds support for comparing multiple files against one another

      └──▷ GET THIS VERSION 
      $ git clone --branch release-2.2 https://github.com/ssdeep-project/ssdeep.git
# already have the repo? check out this version:
$ git checkout release-2.2
      • Added capability to compare two or more files containing signatures against one another

      1 detail in Everything

    5. release-2.5 Jun 27, 2017 · release notes

      ssdeep 2.5 adds C++ compilation support and error-returning API functions.

      └──▷ GET THIS VERSION 
      $ git clone --branch release-2.5 https://github.com/ssdeep-project/ssdeep.git
# already have the repo? check out this version:
$ git checkout release-2.5
      • API documentation is added to the release artifacts
      • API functions now return values indicating errors instead of undefined behavior on failure
      • Project can be compiled with a C++ compiler (C++ compatibility)

      3 details in Everything

    6. release-2.7 Jun 27, 2017 · release notes

      ssdeep 2.7 adds support for processing up to 100MB of data from stdin

      └──▷ GET THIS VERSION 
      $ git clone --branch release-2.7 https://github.com/ssdeep-project/ssdeep.git
# already have the repo? check out this version:
$ git checkout release-2.7
      • Adds the capability to process the first 100MB of data from standard input

      1 detail in Everything

    7. release-2.9 Jun 27, 2017 · release notes

      ssdeep 2.9 adds clustering mode to group matching files and increases stdin limit to 512MB

      └──▷ GET THIS VERSION 
      $ git clone --branch release-2.9 https://github.com/ssdeep-project/ssdeep.git
# already have the repo? check out this version:
$ git checkout release-2.9
      • Increases maximum hashable data on stdin from previous limit to 512MB

      1 detail in Everything

    8. release-2.11 Jun 27, 2017 · release notes

      Adds fuzzy_clone function to the ssdeep API for generating clone signatures.

      └──▷ GET THIS VERSION 
      $ git clone --branch release-2.11 https://github.com/ssdeep-project/ssdeep.git
# already have the repo? check out this version:
$ git checkout release-2.11
    9. release-2.13 Jun 27, 2017 · release notes

      ssdeep 2.13 adds fuzzy_set_total_input_length to API and supports files up to 192GB.

      └──▷ GET THIS VERSION 
      $ git clone --branch release-2.13 https://github.com/ssdeep-project/ssdeep.git
# already have the repo? check out this version:
$ git checkout release-2.13
      └──▷ USE IT
      Retrieve the total input length of a fuzzy hash set via the API.
      python 
      result = api.fuzzy_set_total_input_length(hash_set)
      • Adds support for files up to 192GB
      • Adds support for arbitrary length input from the standard input

      2 details in Everything

    10. 2012-02-16 Jesse Kornblum <research@jessekornblum.com>: Feb 16, 2012 · release notes

      ssdeep adds a clustering mode via the new mode_cluster flag

    11. 2010-07-15 Jesse Kornblum <research@jessekornblum.com>: Jul 15, 2010 · release notes

      ssdeep adds CSV quote handling for filenames with commas or quotes.

      • Adds quote escaping to filenames displayed in csv matching mode.
      • Updates FILEFORMAT documentation to reflect the new quotation rules for CSV output.

      2 details in Everything

    12. 2008-02-17 Jesse Kornblum <research@jessekornblum.com>: Feb 17, 2008 · release notes

      ssdeep 2008-02-17 adds Win32 DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. build support and error state validation.

      • Adds runtime validation check in print_error functions to verify state validity before printing.

      1 detail in Everything

    13. 2008-02-16 Jesse Kornblum <research@jessekornblum.com>: Feb 16, 2008 · release notes

      ssdeep 2.0 beta1 adds API functions for hashing buffers or file handles and moves code into engine.c/fuzzy.c

      • Ammended API functions to support hashing either a buffer or an open file handle
      • Brought over code to support Unicode from Miss Identify

      2 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Removed block_size value from state variable.

    Project health

    Issue, contributor and maintainer activity in ssdeep-project/ssdeep, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 2 +1 vs prior 12 months
    2. Maintainers 1 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close 5.7 years issues closed, last 12 months
    6. Open backlog 11 of 31 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 11
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 799
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback