download safety

How to verify your download

Every file on dAppCDN comes with its checksums. In a minute, you can make sure the file on your computer is exactly the one the developer released.

Why verify

A checksum is a fingerprint of a file: change a single byte and it changes completely. Comparing the checksum of your download with the one we publish proves that the file was not damaged on the way or replaced by someone else. We use SHA-256, the strongest of the checksums we show.

1. Find the checksum on dAppCDN

  1. Open the product page of the software and go to its downloads.
  2. Next to the file you downloaded, click Signature: the File Signatures window opens.
  3. Copy the value under SHA256 with its copy button.

2. Compute the checksum of your file

Windows (PowerShell). Open PowerShell in the folder of the file and run:

Get-FileHash .\example-app-setup.exe -Algorithm SHA256

Windows (Command Prompt). The same with the built-in certutil:

certutil -hashfile example-app-setup.exe SHA256

macOS. In Terminal:

shasum -a 256 ~/Downloads/example-app.dmg

Linux. In a terminal:

sha256sum example-app.tar.gz

Or let it compare for you, with the value copied from dAppCDN:

echo "<sha256 from dAppCDN>  example-app.tar.gz" | sha256sum -c -

Replace the file names in the examples with the name of the file you downloaded.

3. Compare the two values

The value you computed must be identical to the one on dAppCDN, character by character (capital and small letters do not matter). If they are identical, the file is exactly the official one.

More checks

The developer's signature

Some developers sign their releases. When they do, File Signatures also offers the signature file (for example .asc or .sig). With the developer's public key, taken from their official website, you can check it with GnuPG:

gpg --verify example-app.tar.gz.asc example-app.tar.gz

Signed Windows programs

Many Windows programs are signed by their publisher. Right-click the file, choose Properties, then Digital Signatures: the signer should be the developer or company that makes the software.

The antivirus report

Every file is scanned by multiple antivirus engines before it is published, and the report is on its product page. A file that fails the scan is never offered for download.

If something does not match

  • Do not open or install the file. Delete it.
  • Download it again from its product page on dAppCDN, then check again.
  • If the checksum still does not match, tell us which software and file it was. We look into every report.