SYS-LOG
[BOOT] Awaiting client-side events...
Press ~ to toggle. Client-side only.
ECHO-DETECT [04]

EchoDetect

Binary Similarity Forensics

ANY FORMATCTPH / SSDEEPSHA-2560–100 SCORE

[ SYSTEM NOTE ] Fuzzy hashing detects similarity even when bits were added, removed, or modified. SHA-256 cross-reference confirms cryptographic identity. All computation runs locally.

INPUT FILES
[A]

DROP FILE A OR CLICK

any format · up to 100.00 MB [FREE]

[B]

DROP FILE B OR CLICK

any format · up to 100.00 MB [FREE]

ABOUT ECHODETECT

EchoDetect compares two files using context-triggered piecewise hashing (CTPH), the same algorithm behind SSDeep — a fuzzy hashing technique that detects structural similarity even when bytes have been added, removed, or modified. A SHA-256 cross-reference is performed simultaneously to check for cryptographic identity. The result is a similarity score from 0 to 100 and a clear verdict.

USE CASES

  • Detect whether a document received via email has been tampered with compared to your original
  • Find near-duplicate files in large archives where filenames may differ
  • Compare firmware images to detect unauthorised modifications
  • Identify malware variants that have been lightly modified to evade hash-based detection

FREQUENTLY ASKED

What is fuzzy hashing?+
Traditional hashing (SHA-256, MD5) produces completely different outputs for even a 1-bit change. Fuzzy hashing computes context-sensitive signatures that remain similar when the file content is similar — a 5% change produces a score around 95 rather than a completely unrelated hash.
How is EchoDetect different from a file diff tool?+
A diff tool shows exactly which lines changed, optimised for text. EchoDetect works on raw bytes and is format-agnostic — it can compare a JPEG to a slightly modified JPEG without understanding the file format. It answers 'how similar are these?' rather than 'what exactly changed?'
What does a score of 0 mean?+
A score of 0 means the two files share no detectable structural similarity — they are essentially unrelated. A score of 100 means the files are byte-for-bit identical, confirmed by the SHA-256 cross-check.