How to verify a Windows download before you install it

Every installer on this catalog ships with a published size and SHA-256. Treat those fields as part of the download, not as optional footnotes.

1. Confirm the page before you click

Open the program page from search or a category, not from a random redirect. Check the program name, current version, and that the download button is labeled for that build.

2. Compare the hash after the file lands

Once the file is on disk, hash it with PowerShell:

Get-FileHash .\program-setup.exe -Algorithm SHA256

The hex string should match the SHA-256 on the release. If Tide Download Manager finished the transfer for you, paste the published hash into its checksum panel instead of typing it by hand.

3. Read the signature status

A signed installer is not a guarantee of quality, but an unexpected unsigned executable deserves a second look—especially when the publisher usually ships signed builds.

4. Install with a narrow path

Extract archives with a tool that lists paths first, such as Harbor Zip. For unknown installers, run them once inside Sandbar before giving them a permanent profile.

Verification is cheap. Cleaning a compromised user profile is not.