> ## Documentation Index
> Fetch the complete documentation index at: https://docs.decodalabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart

> Upload your first sample and run your first analysis in under five minutes.

## 1. Create Your Account

Head to [decodalabs.com](https://decodalabs.com) and sign up. DECODA supports OAuth and SAML authentication via WorkOS. Once you've signed in, you'll land on the analysis screen.

<Tip>The free tier includes 25 Ask queries and 5 Agent Credits per month, so you can try everything without a credit card.</Tip>

When you first sign up, DECODA sends a welcome email to your address with a link straight to your dashboard.

## 2. Upload a Sample

From the main screen, you can upload a file in two ways:

* **Drag and drop** a file directly onto the input area
* **Click the attach button** to browse your filesystem

DECODA supports executables (PE, ELF, Mach-O), scripts, Office documents, PDFs, JAR files, and archives (ZIP, with zip bomb detection).

Each tier enforces a file-size limit when you attach a file. If a file exceeds your limit, an error toast appears and the file is not attached. DECODA also surfaces informational warning toasts for suspicious files, such as a double extension (for example `document.pdf.exe`) or an executable. These warnings are advisory only and do not block the upload, since the sandbox provides isolation. The per-tier size limits are Free 30 MB, Pro 100 MB, and Max 200 MB; see [Billing](/guides/billing) for the full plan comparison.

<Note>Uploaded files are stored securely. All analysis runs inside isolated sandboxes with no network access.</Note>

## 3. Wait for Triage

As soon as your file uploads, DECODA's automated triage pipeline kicks in. You'll see real-time progress as it:

1. **Hashes** the file (MD5, SHA1, SHA256; plus imphash for PE files)
2. **Scans** with built-in YARA rulesets (malware families, packers, ransomware signatures)
3. **Classifies** the binary type and extracts metadata (PE sections, compilation timestamps, security flags)

Triage results appear as a summary card in your chat within seconds.

## 4. Start Analysing

You have two modes to choose from. Toggle between them at the top of the input area.

### Ask Mode

Type a question in plain English and get an instant response. Great for:

* "What type of file is this?"
* "Does this sample use any known packing techniques?"
* "Explain what the YARA matches mean"

Ask mode uses a fast LLM and doesn't run any sandbox tools. It's ideal for quick triage questions.

### Agent Mode

For deeper analysis, switch to Agent mode. The AI will autonomously decide which tools to run, execute them in a sandboxed microVM, and synthesise the results. For example:

* "Decompile the main function and explain what it does"
* "Extract all network IOCs from this sample"
* "Run a full static analysis and generate a report"

You'll see each tool execution streamed in real time as the agent works.

<Info>See the [Analysis Modes](/guides/analysis-modes) guide for a full breakdown of both modes and the available tools.</Info>

## 5. Generate a Report

Once you have enough findings, ask the agent to generate a report:

> "Generate a threat intelligence report for this sample"

The report includes an executive summary, technical analysis, IOCs (network, file, and host indicators), and MITRE ATT\&CK technique mappings. You can download it as Markdown, PDF, or HTML.

## Next Steps

<CardGroup cols={2}>
  <Card title="Analysis Modes" icon="code" href="/guides/analysis-modes">
    Deep dive into Ask vs Agent mode and the full tool catalogue.
  </Card>

  <Card title="Triage Pipeline" icon="microscope" href="/guides/triage">
    Learn exactly what the automated triage does and how to read the results.
  </Card>
</CardGroup>