Best Malware Analysis Sandboxes in 2026
Updated
In short: ANY.RUN is ranked #1 of 24 as of 4 October 2026, ahead of Retrace and Malwagon. The best-ranked option with a free plan is Retrace. The lowest first paid tier on this page is Bitdefender Total Security at $5/mo.
When you need to inspect a suspicious file or URL, a malware analysis sandbox provides a contained setting for that work. Compare URL analysis, network traffic analysis and IOC extraction to see which investigation capabilities are specified, then consider API access and result retention. Deployment model and file size limit can affect practical fit, while free-plan availability and paid-from pricing add access and cost context. The ranking starts with ANY.RUN and Bitdefender Total Security, with Retrace and Hatching Triage also among the first entries. Use the criteria to match the listed capabilities and sample limits to the analysis work you need to do.
24 malware analysis sandboxes ranked on what their makers publish — plans and prices, free tiers, platforms and the facts on their own pages.
#1 ANY.RUN Top pick · 7.4 Free plan · Free #2 Retrace Runner-up · 7.3 Free plan · Free
#3 Malwagon Also great · 7.2 Free plan · $79/mo- Free planFree trial AndroidapiiOSLinuxmacOSWebWindows
- Free plan
- Yes
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - Free plan AndroidapiLinuxmacOSself-hostedWebWindows
- Free plan
- Yes
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - Free plan apiLinuxmacOSWebWindows
- Free plan
- Yes
- Paid from
- 79 /mo
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms$79/mofirst paid tier About MalwagonVisit site - Free plan apiLinuxself-hostedWebWindows
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - Free trial AndroidiOSmacOSWindows
- Free plan
- No
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms$5/mofirst paid tier About Bitdefender Total SecurityVisit site - AndroidiOSLinuxmacOSWebWindows
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - AndroidapiLinuxmacOSself-hostedWebWindows
- Free plan
- Yes
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - Free planFree trial apiWeb
- Free plan
- Yes
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - Free trial AndroidapiiOSLinuxmacOSWebWindows
- Free plan
- No
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms$8.33/mofirst paid tier About CrowdStrike Falcon ProVisit site - AndroidapiLinuxmacOSWebWindows
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - apiself-hostedWeb
- Free plan
- No
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - Windows
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
RecognisedDocumentedFree planPlatforms - WebWindowsAndroid
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - Windows
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - WebLinux
- URL analysis
- No
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - WebLinux
- Free plan
- Yes
- URL analysis
- No
- API access
- Yes
- Network traffic analysis
- Yes
RecognisedDocumentedFree planPlatforms - Web
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - Web
- Free plan
- No
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - AndroidapiLinuxself-hostedWebWindows
- Free plan
- No
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms -
- URL analysis
- Yes
- API access
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - WebWindows
- Free plan
- No
- URL analysis
- Yes
- Network traffic analysis
- Yes
- IOC extraction
- Yes
RecognisedDocumentedFree planPlatforms - Web
- API access
- Yes
RecognisedDocumentedFree planPlatforms - LinuxmacOSWindowsRecognisedDocumentedFree planPlatforms
- Web
- API access
- Yes
RecognisedDocumentedFree planPlatforms
Is your app on this list?
Numbered spots on this list can be sponsored. They are labelled, and the editorial order and scores never change for payment.
Questions about this list
Which malware analysis sandboxe is ranked first on Everything Xiaomi?
ANY.RUN is ranked #1 of 24 with a score of 7.4. Retrace is second and Malwagon third.
How many of these have a free plan?
5 of the 24 on this page publish a free plan on their own pricing pages.
Which is the cheapest paid option?
On this page, Bitdefender Total Security has the lowest first paid tier we found: $5/mo.
How is this list ranked?
Ranked on what each maker publishes: documentation depth, a free tier and the platforms it runs on. Paid placements never change a rank.