Subscription Tiers & Features#

HashWatch has one public surface and one private surface:

• The public dashboard (“hash of the day”) is free and needs no account, key, or sign-in.
• The private threat-intel API and the admin console are reached with an API key or a console sign-in, and what they unlock is governed by your account’s tier.

The tiers form a ladder: free → basic → teams → enterprise . Every step includes everything below it. A key carries both a role (what actions it may take) and a tier (which features are unlocked); a request must satisfy both.

teams was formerly called paid (renamed 2026-06-17). paid is still accepted as a deprecated alias and folds to teams automatically.

Feature matrix#

The per-feature gates above are the authoritative ones the API enforces (PermMinTier); they are not marketing copy. The endpoint-by-endpoint version is in Authentication → Permissions.

Delivery & integration. The status page, transparency log, and the hashwatch verify CLI are free — the CLI checks against a local, offline cache of the public verified set (refreshed at most once a day), and an API key simply widens it to the full corpus. The pull feeds (JSON/RSS/STIX/TAXII) require a HashWatch API key. See Integrations.

API usage & quotas. Every authenticated account can see its own usage (this-month total, per-endpoint breakdown, 30-day series) in the console, and each tier carries a monthly request quota (Basic 50,000 · Teams 500,000 · Enterprise unlimited; over-quota returns 429).

The console only shows what your tier can use. A Basic account never sees Teams or Enterprise controls in the UI, and a Teams account never sees Enterprise-only controls — the navigation and dashboard hide above-tier features (and the API enforces the same limits server-side).

Paste-to-verify on the public dashboard. The public dashboard has a “Verify a hash” box: paste any SHA-256 / SHA-1 / MD5 and get an instant answer. Without signing in (free), the check runs against today’s published feed. Signed-in paid accounts (basic and up) additionally verify against the full known-good corpus, including older / superseded versions — reporting the matching vendor build (with version, flagged when it is an older/superseded release), a reference-corpus (NSRL) match, or not-found. The programmatic form is POST /api/v1/intel/lookup (current releases) and POST /api/v1/intel/lookup/historical (also older versions).

What each tier is for#

Free - the public dashboard#

The “hash of the day”: verified cryptographic hashes of common executables, sourced daily from official vendor channels. No account, no key, no sign-in. This is the only surface that needs nothing.

Basic - API access + known-good lookups + history#

The entry point to the private API. A Basic account can authenticate a key and run the core intel calls - hash lookup against the BinTrust/NSRL corpus, platform statistics, and historical hash queries (intel:history: what a file’s official hash was on any past date). Ideal for an analyst or an automated triage pipeline that needs “is this file known-good?” and “was this the official hash back then?” answers.

A Basic account is single-user: it has exactly one Account Admin — its shared organization API key — and cannot add other personnel. Viewer/Analyst members and a second admin (i.e. a team) require the Teams tier; the platform refuses to attach a Viewer/Analyst role to a below-Teams account.

Teams - RevokeRadar + multi-user self-service#

Everything in Basic, plus the download / provenance audit trail and RevokeRadar - the revoked-certificate feed and its queryable revocation history / timeline (so you can see exactly when a code-signing cert was revoked) - and the self-service admin console: invite multiple console users (Viewers and Analysts), and have up to two Account Administrators manage your own account’s members and keys. This is the tier at which an account becomes a team rather than a single key.

Enterprise - Teams at organization scale#

Enterprise includes the complete Teams feature set and is aimed at whole-organization deployments: the single shared organization API key model (see below) across the company, and white-label role/tier labels so the console can carry your own terminology. Customer-facing intel capabilities are the same as Teams - Enterprise is the commercial tier for scale, onboarding, and branding rather than a separate set of gated endpoints.

How keys and users fit together#

• Every paid account is auto-provisioned one shared organization API key at signup, carrying the account’s tier (an Account Administrator key). The raw secret is shown once at creation. This single key is the org’s programmatic credential - even a Basic account gets one, so there is no tier at which “you can pay but still have no API access.” Additional keys can be issued later if you need them.
• People use the web console through individual invites (Teams and Enterprise), each enrolling their own passkey/authenticator - so multiple humans share the console while the organization keeps one API key for automation. An account is capped at two Account Administrators (one primary, one backup).

HashWatch-operated capabilities (for awareness)#

Some capabilities exist on the platform but are never customer features - they are operated by HashWatch staff only and are listed here purely for transparency:

• Tenant impersonation (tenant:impersonate) - support staff can view-as or manage-as your tenant to help troubleshoot; every such action is recorded in the audit log with the staff member as the actor.
• Platform administration (platform:keys, platform:settings, platform:admins)
  • managing keys across all tenants, platform settings, and platform administrators.

These will never appear in a customer console regardless of tier; the API rejects them for any customer key.