How to verify a downloaded installer

Every installer on this catalog ships with a published size and SHA-256. Treat those fields as part of the download, not as optional footnotes.

1. Confirm the page before you click

Open the program page from search or a category, not from a random redirect. Check the program name, current version, and that the download button is labeled for that build.

2. Compare the hash after the file lands

Once the file is on disk, hash it with PowerShell:

Get-FileHash .\program-setup.exe -Algorithm SHA256

The hex string should match the SHA-256 on the program page. Archive tools such as 7-Zip help you inspect paths inside zip packages before you extract them.

3. Read the signature status

A signed installer is not a guarantee of quality, but an unexpected unsigned executable deserves a second look—especially when the publisher usually ships signed builds.

4. Install with a narrow path

For USB writers such as Rufus, confirm the target drive letter twice. Keep a second-opinion scanner like Malwarebytes available, and capture screenshots of setup dialogs with ShareX if you need a paper trail.

Verification is cheap. Cleaning a compromised user profile is not.

For publisher identity, SmartScreen warnings, and a Windows Security scan, continue with How to Check if a Windows Program Is Safe Before Installing It.