DESIGN.md · Analysis

VirusTotal

virustotal.com · 10 Sept 2026 · 47 colors · Google Sans, Source Sans Pro

VirusTotal

VirusTotal is a security analysis platform that detects malware, phishing, and threats across files, domains, IPs, and URLs through collaborative threat intelligence.

Colors

surface#161625
surface-dim#0f0f1a
surface-bright#1f1f2e
surface-container-lowest#0a0a14
surface-container-low#121219
surface-container#161625
surface-container-high#1e1e2d
surface-container-highest#262635
on-surface#ffffff
on-surface-variant#c3d2e8
inverse-surface#ffffff
inverse-on-surface#161625
outline#3d4a69
outline-variant#2f3d5c
surface-tint#86aaf9
primary#86aaf9
on-primary#0f2a5f
primary-container#1e3a7a
on-primary-container#d4e1ff
inverse-primary#0b4dda
secondary#39ac4c
on-secondary#ffffff
secondary-container#2d7a3a
on-secondary-container#c8f0d0
tertiary#e57300
on-tertiary#ffffff
tertiary-container#b35900
on-tertiary-container#ffe5cc
error#ff5a50
on-error#ffffff
error-container#c52420
on-error-container#ffe5e0
primary-fixed#d4e1ff
primary-fixed-dim#86aaf9
on-primary-fixed#0f2a5f
on-primary-fixed-variant#1e3a7a
secondary-fixed#c8f0d0
secondary-fixed-dim#39ac4c
on-secondary-fixed#0d3d1a
on-secondary-fixed-variant#2d7a3a
tertiary-fixed#ffe5cc
tertiary-fixed-dim#e57300
on-tertiary-fixed#4d2800
on-tertiary-fixed-variant#b35900
background#161625
on-background#ffffff
surface-variant#2f3d5c

Typography

display
fontFamily: Google Sans · fontSize: 56px · fontWeight: 700 · lineHeight: 64px · letterSpacing: -0.02em
headline-lg
fontFamily: Google Sans · fontSize: 40px · fontWeight: 600 · lineHeight: 48px · letterSpacing: -0.01em
headline-md
fontFamily: Google Sans · fontSize: 28px · fontWeight: 600 · lineHeight: 36px · letterSpacing: 0em
title-lg
fontFamily: Google Sans · fontSize: 20px · fontWeight: 600 · lineHeight: 28px · letterSpacing: 0.01em
body-lg
fontFamily: Source Sans Pro · fontSize: 18px · fontWeight: 400 · lineHeight: 28px · letterSpacing: 0em
body-md
fontFamily: Source Sans Pro · fontSize: 14px · fontWeight: 400 · lineHeight: 22px · letterSpacing: 0em
label-md
fontFamily: Google Sans · fontSize: 12px · fontWeight: 600 · lineHeight: 16px · letterSpacing: 0.05em
label-sm
fontFamily: Google Sans · fontSize: 11px · fontWeight: 500 · lineHeight: 14px · letterSpacing: 0.08em

Design guidance

Overview

VirusTotal is a collaborative security analysis platform that transforms threat detection into an intuitive, data-driven experience. The design system embodies "Technical Clarity"—a modern aesthetic that balances the precision of security intelligence with the accessibility of a consumer-grade interface. The brand serves security researchers, IT professionals, and enterprises who need to rapidly assess file, domain, IP, and URL threats. The UI evokes confidence through a dark, focused canvas (rgb(22, 22, 37)) punctuated by a distinctive periwinkle accent (rgb(134, 170, 249)) that signals actionable insights and interactive elements. The emotional response is one of control: users feel empowered to investigate threats without cognitive overload.

Voice: authoritative yet approachable, technical but never jargon-heavy. VirusTotal speaks in declarative, outcome-focused sentences. Example: "Scan complete: 47 vendors flagged this file as malicious. Review detections below." The vocabulary favors action verbs (detect, analyze, share, investigate) and avoids marketing hyperbole. Tone is calm and reassuring, even when reporting critical threats—the interface itself conveys urgency through color and hierarchy, not through breathless language.

Colors

The color system is anchored in a dark, high-contrast foundation designed for extended viewing and rapid threat assessment. Surface (#161625, rgb(22, 22, 37)) serves as the primary canvas, with a carefully calibrated surface stack (surface-container-lowest #0a0a14 through surface-container-highest #262635) providing semantic depth for layered UI elements like modals, drawers, and nested cards. The on-surface palette (#ffffff for primary text, #c3d2e8 for secondary) ensures WCAG AA compliance (contrast ratio ≥4.5:1) across all text sizes.

Primary (#86aaf9, rgb(134, 170, 249)) is the brand's signature accent—a cool periwinkle reserved exclusively for interactive elements: CTA buttons, active tab underlines, link text, and focus states. This color appears in the hero logo, the "Sign up" butt

Typography

The type system pairs Google Sans (headlines, labels, UI controls) with Source Sans Pro (body copy, descriptions, data tables), creating a visual hierarchy that guides users from high-level threat summaries to granular analysis details. Display (56px, 700 weight, -0.02em tracking) anchors hero sections and major page titles. Headline-lg (40px, 600 weight) introduces primary sections; headline-md (28px, 600 weight) breaks up subsections. Title-lg (20px, 600 weight) labels cards and modal headers. Body-lg (18px, 400 weight, 28px line-height) is used sparingly for introductory copy; body-md (14px, 400 weight, 22px line-height) is the default for descriptions, table cells, and form helper text. Label-md (12px, 600 weight, 0.05em tracking) and label-sm (11px, 500 weight, 0.08em tracking) are ap

Layout

The page layout uses a 12-column grid with a max-width of 1300px (--max-page-width), centered on the viewport. The hero section spans full width with 40px (lg spacing) vertical padding top and bottom, creating breathing room around the VirusTotal logo and tagline. The main content area (file/URL/search tabs and upload zone) uses a fixed gutter of 24px (md spacing) between columns and sections. White-space philosophy emphasizes clarity: 40px (lg) separates major sections (hero, upload area, footer callout), 24px (md) divides subsections and card groups, and 12px (sm) provides breathing room within components. The container respects a max-width of 1300px to prevent line-length bloat on ultra-wide displays. Responsive breakpoints scale spacing proportionally: on mobile, gutter reduces to 16px

Elevation & Depth

Depth is conveyed through a layered shadow system and strategic use of surface-container tokens. The base layer (Level 0) is the body background (#161625). Level 1 (Standard Cards) uses surface-container (#161625) with a 1px border in outline-variant (#2f3d5c) and a subtle sm shadow (0 2px 2px 0 rgba(0, 0, 0, 0.24)). Level 2 (Elevated Cards, Hover States) shifts to surface-container-high (#1e1e2d) with md shadow (0 3px 8px rgba(0, 0, 0, 0.15)). Level 3 (Modals, Drawers, Popovers) uses surface-container-highest (#262635) with lg shadow (0 8px 10px -5px rgba(0, 0, 0, 0.2), 0 16px 24px 2px rgba(0

Shapes

The shape philosophy is "Technical Precision"—rounded corners are used judiciously to soften hard edges while maintaining a sense of control and structure. Buttons and primary interactive elements use lg (1rem / 16px) border-radius, creating a friendly but professional appearance. Input fields, tabs, and secondary containers use DEFAULT (0.375rem / 6px) for a tighter, more technical feel. Cards and modals use lg (1rem) to signal importance and elevation. Badges and pills use full (50%) for maximum visual distinction. The rationale: larger radii (lg, xl) are reserved for elements that demand us

Components

Action Elements Buttons follow a strict hierarchy. Primary buttons (button-primary) use background: {colors.primary} (#86aaf9), text-color: {colors.on-primary} (#0f2a5f), padding: 12px 24px, height: 44px, rounded: lg (1rem), and typography: label-md (12px, 600 weight, 0.05em tracking). On hover (button-primary-hover), background shifts to #7a9ee8 with a 200ms ease-out transition. Secondary buttons (button-secondary) are transparent with a 1px border in {colors.outline} (#3d4a69), text in {colors.primary}, and the same padding/height/rounded specs. Ghost buttons (button-ghost) are minimal—transparent background, {colors.primary} text, 8px 16px padding, no border—used for tertiary actions and navigation links. All buttons disable with opacity: 0.5 and cursor: not-allowed.

Containers

Do's and Don'ts

**Do**

  • Do use primary (#86aaf9) exclusively for interactive elements—buttons, links, active states, and focus indicators—to create a consistent, scannable interface.
  • Do maintain the 24px (md) gutter between major sections and 12px (sm) within component groups to preserve visual breathing room and reduce cognitive load.
  • Do apply label-md (12px, 600 weight, 0.05em tracking) to all button text and UI chrome; reserve body-md (14px, 400 weight) for descriptions and data.
  • Do use the surface-container stack (surface-container-low through surface-container-highest) to signal elevation and hierarchy; never hardcode grays or arbitrary background colors.
  • Do add a 3px primary-colored focus outline (rgba(134, 170, 249, 0.12)) to all interactive elements for keyboard navigation and accessibility compliance.

**Don't**

  • Don't use secondary (#39ac4c) or tertiary (#e57300) as primary CTAs; reserve them for status indicators (success, warning) and supporting actions.
  • Don't apply border-radius > lg (1rem) to buttons or form controls; the technical aesthetic requires crisp, controlled curves, not soft, rounded pills.
  • Don't mix Google Sans and Source Sans Pro within a single component; use Google Sans for UI labels and headlines, Source Sans Pro for body copy and data tables only.
  • Don't hardcode shadows; always reference the elevation tokens (sm, md, lg) to maintain consistency and enable theme-wide adjustments.
  • Don't exceed 1300px container max-width or use gutter values outside the defined spacing scale (xs, sm, md, lg, xl); this breaks the grid rhythm and introduces visual chaos.