The Everyversion API

215 apps. 14,265 versions. Every download link, SHA-256 checksum and license, as plain JSON you can fetch right now. No key, no signup, no price.

Open the index

Who this is for

• You write tools for older machines. You need to know which version is the newest, which are older, and where each one lives.
• You run an AI agent or assistant. Someone asks “where do I download that old version?” and you want an answer from data, not a guess.
• You look after a fleet of PCs. You want to check every download against its checksum before it reaches anyone.

Why it’s just files

There is no database or application server behind this. The whole site is built into plain files from one set of data, and the JSON is that same data. So there is no account to create and no key to manage. You fetch a file and you get the facts.

What each link does

Try it in 30 seconds

These examples use curl and jq, plus one in JavaScript. Each one was run against the live data before it went on this page.

curl -s https://everyversion.net/api/v1/apps.json \
  | jq '.apps[] | select(.slug=="vlc") | {name, latest_versions, license}'

curl -s https://everyversion.net/api/v1/apps.json \
  | jq -r '.apps | sort_by(.last_updated) | reverse | .[:5][] | "\(.last_updated)  \(.name)"'

curl -s https://everyversion.net/api/v1/apps.json \
  | jq -r '.apps[] | select(.category=="vpns") | .name'

data=$(curl -s https://everyversion.net/vlc/vlc.json)
pick='[.versions[] | select(.platform=="windows")][0] | [.installers[] | select(.architecture=="x64")][0]'
url=$(printf '%s' "$data" | jq -r "$pick | .url")
sha=$(printf '%s' "$data" | jq -r "$pick | .sha256")

curl -LO "$url"
printf '%s  %s\n' "$sha" "$(basename "$url")" | shasum -a 256 -c

const res = await fetch('https://everyversion.net/api/v1/apps.json');
const { apps } = await res.json();

const open = apps.filter((a) => a.pricing === 'open-source' && a.platforms.includes('windows'));
console.log(open.length, 'open-source Windows apps');

curl -s https://everyversion.net/vlc/vlc.md

What the fields mean

• slug is the app’s short name and its address: /{slug}/.
• platforms is a list drawn from windows, macos and linux. latest_versions gives the newest version on each.
• last_updated is the date of the newest release in our data (YYYY-MM-DD). Some apps have none, so check for it.
• pricing is one of open-source, freeware, free-to-download or unknown. “Free to download” is a label we set by hand, and it can still mean paid tiers exist.
• versions_total is how many versions the source has. We list up to 50 per platform. On the Mac side, most sources list only the current release.
• ids holds the identifiers the app goes by in its source, such as its winget ID, Homebrew cask or Flathub app ID. Not every app has every one.
• category is the slug of the app’s main category, as listed in categories.json.

Can you trust the checksums?

You can trust them as far as the file says. Look at verification.level in an app’s file:

• Level 0: the SHA-256 values are copied from the package listing or the publisher’s own checksum files. We have not re-computed them.
• Level 1: we downloaded the installers, re-computed each SHA-256 and compared it. verification.checked_at says when.

Two more things. We host no installers, so every url points to the download location named in the publisher’s package data, which we can’t control. And a matching checksum shows a file is the one that was published. It does not show the file is safe. Read the Security page for what our checks can and can’t tell you.

House rules

• Fetch once, then cache. The files change when we process new data, not every minute. Keeping the index for a day is plenty, and one request at a time is plenty.
• Say who you are. A clear User-Agent helps if I ever need to reach you.
• Give credit and respect licenses. The data comes from public package catalogs and publishers’ own feeds. Link back to the page you used, and follow the license of any software you handle. See Content & takedown requests.
• Expect new fields. The v1 in the path is there so a breaking change can ship as v2. New fields can appear in v1, so read the ones you need and ignore the rest.
• Browsers on other sites. These files are meant for scripts, servers and agents. Whether a page on another website can read them depends on the server’s CORS settings, which we don’t promise.
• No guarantees. The Terms of Service apply, including the parts about accuracy and availability.

Missing something?

If you need a field that isn’t there, an app that isn’t listed, or a file in a different shape, tell me. The list grows from requests like yours.

Write to me Or just start with the index