Security and Trust Center

You should be able to see exactly how a file was checked before you run it. Here is the whole process, including what it cannot tell you.

Checks run and maintained by Cristian Gonzalez Guasch. So far: 112 of 120 apps and 377 files checked end to end.

The short version

• We host no installers. Every download link goes to the original source: the publisher, or a repository or archive.
• For checked software, we download the files ourselves and re-compute their SHA-256.
• We check the code signature where our tools can.
• We look each file up on VirusTotal by its hash and show the real result. We never invent a score.
• Every result carries a date, so you can see how old it is.

How a file gets checked

1. Source. We start from public package catalogs. Each app page names its source, the revision we read and the date.
2. Download. We fetch the installer from its original source, not from a mirror of ours.
3. Hash. We re-compute the SHA-256 and compare it with the catalog’s value. A match means the file is byte for byte the one that was recorded. If it does not match, the page says so in plain words.
4. Signature. For Windows files we verify the Authenticode signature, including its timestamp, against the operating system’s trusted roots plus a small set of Microsoft roots whose fingerprints we checked against Microsoft’s own published list. For macOS files we run Apple’s codesign.
5. VirusTotal. We look up the file’s SHA-256 on VirusTotal. This sends only the hash, never the file.
6. Publish. The page shows each result and its date. We delete the downloaded files afterwards.

Verification levels

How to read the score

The score on an app page comes from VirusTotal’s last scan. VirusTotal runs a file through dozens of security engines. We take the share of engines that did not flag the file:

score = 100 × (engines − malicious − suspicious) ÷ engines

• Green, Clean or Mostly clean. No engine, or just one engine, flagged any scanned file. A lone flag among 50 or more engines is usually a false alarm, so it does not change the rating. We still list it under Detections.
• Orange, Some detections. Two or three engines flagged a file. Open the full report.
• Red, Many detections. Four or more engines flagged a file. Do not run it before you read the report.
• No ring, Not scanned yet. VirusTotal has no report for that hash, or we have not looked it up yet. We show no score.

The label under the title on an app page follows the same colors: green is “Safe”, orange is “Medium risk”, red is “High risk”, and no scan is “Not scanned”. “Safe so far” means the files we could scan are clean but some files have no report yet.

When an app has several installers, the ring shows the lowest score and the colour follows the most-flagged file. If VirusTotal has a report for only some of the files, the page says “Covers X of Y files” and the label becomes “No detections so far” instead of “Clean”. A partial result never speaks for the files it did not scan.

What these checks cannot tell you

• A clean scan is not a guarantee. Scanners miss things, and new malware can go unflagged for days.
• A matching hash proves the file is the one that was published. It does not prove the publisher’s file is harmless.
• A valid signature proves who signed the file and that it was not changed afterwards. It does not prove the software is good.
• “Not signed” on a macOS disk image means the image itself carries no signature. The app inside may still be signed. We have not checked that yet.
• Some formats, such as ZIP archives and .msix packages, are not signature-checked by our tools. The page shows “Not applicable”.
• Older versions can contain security flaws that later versions fixed. That is the trade you make when you choose them. See the disclaimer.
• We are not affiliated with VirusTotal or any publisher.

What we do not do yet

• We do not monitor publishers, domains or certificates for changes.
• We do not re-scan on a schedule. Each result shows its date.
• We do not check the apps inside macOS disk images.

Check it yourself

Do not take our word for it. These commands take seconds.

Found something wrong?

If a result looks wrong, a link is dead, or a hash does not match what you computed, tell us. Send the page URL and the value you got. We will re-check it and fix the page.