Windows & Mac · Guide
How to Check Whether a Software Download Is Safe
Short answer
Confirm you are on the developer's own domain, check the installer's digital signature, verify the published checksum when one exists, and read every setup screen for bundled offers before clicking Next.
Requirements
- The download you are evaluating
- The developer's official website
- A few minutes before you run the installer
Steps
1. Identify the real developer
Search for the software name plus the developer's name, and confirm the download domain belongs to them. Portal sites often outrank the official page on brand searches.
2. Check the digital signature
On Windows, Properties > Digital Signatures should name the publisher. On macOS, an app that opens without a Gatekeeper block is notarized. An unsigned installer is not automatically malicious, but it deserves more scrutiny.
3. Verify the checksum
If the developer publishes SHA-256, compare it against the file you downloaded.
4. Read each setup screen
Bundled offers hide behind Recommended options. Choose Custom or Advanced installation and uncheck anything you did not come for.
5. Scan before running
Run an on-demand scan on the installer. A single detection can be a false positive; several from unrelated engines is a stop signal.
6. Watch the first launch
New browser extensions, changed search engines, or unexpected startup entries right after installation indicate a repackaged installer.
Alternative methods
1. Use a package manager
winget on Windows and Homebrew on macOS pull from curated sources and skip the download-page problem entirely.
2. Prefer store distribution
The Microsoft Store and Mac App Store enforce review and sandboxing, which removes most bundling risk.
Troubleshooting
The official site is hard to find
Check the project's Wikipedia entry, GitHub organization, or package-manager listing to confirm the canonical domain.
SmartScreen blocks the installer
That often reflects low download volume rather than malware. Verify the publisher and checksum before overriding it.
My antivirus flags an open-source tool
Some system utilities trigger heuristics. Cross-check the specific detection name and the file's origin before deciding.
Frequently asked questions
Are download portals always unsafe?
No, but many wrap installers in their own download manager, which is where unwanted extras appear. The developer's site is the safer default.
Is a signed installer guaranteed safe?
No. A signature proves who published the file, not that the software behaves well. It is one signal among several.