How to Check if a Software Download Is Safe on Windows
The most reliable way to stay safe is to download from the publisher's own website, then check the file's digital signature before you run it. Most fake installers fail one of these two checks. The steps below take a couple of minutes, and they need no extra software.
1. Check where the download comes from
Look at the address bar before you click anything. The site should belong to the company that makes the program, such as videolan.org for VLC. Be careful with:
- Search adverts. Scammers buy adverts for popular program names, and these can appear above the real site. Read the address, not just the title.
- Lookalike addresses. Extra words or changed spellings in the name are a warning sign.
- Large green buttons on download sites. On many sites, including ours, an advert can say Download. On FileConsult the real button is green, and it opens the publisher's site.
Each program page on FileConsult shows the official address it links to, so you can compare it.
2. Check the digital signature
Most established publishers sign their installers. To check, right-click the downloaded file and choose Properties. If there is a Digital Signatures tab, select the entry and click Details, and check that the name matches the publisher you expected.
A missing signature does not always mean danger, because some small open-source projects do not sign their files. A signature from a company you have never heard of is a stronger reason to stop.
3. Compare the SHA-256 fingerprint
A SHA-256 fingerprint is a long code calculated from a file. If one byte changes, the code changes. To get your file's fingerprint, open PowerShell and run:
Get-FileHash "$env:USERPROFILE\Downloads\installer.exe" -Algorithm SHA256
Replace installer.exe with your file's name. Then compare the result with the one listed by the publisher. Our program pages also show fingerprints from Microsoft's winget catalog where they exist. A match shows that you have the same file. It does not show that the program itself is free of problems.
4. Look up the file on VirusTotal
VirusTotal checks a file against many antivirus engines. Searching for the fingerprint on virustotal.com is better than uploading the file, and it avoids sharing a private document by mistake. One or two warnings on a little-known program are often false alarms. Many warnings, especially from well-known engines, are a reason to delete the file.
5. Don't dismiss Windows warnings too quickly
Microsoft Defender SmartScreen may say that it prevented an unrecognised app from starting. This often appears for new or uncommon programs, so it does not prove the file is harmful. Still, treat it as a reason to go through the checks above before you click More info and Run anyway.
Warning signs that should stop you
- A video player or document arrives as an .exe, .bat or .scr file.
- A file name is disguised, like invoice.pdf.exe. Turn on file name extensions in File Explorer so that you can see this.
- A pop-up says your PC is infected and tells you to install something. This is a common trick.
- A password-protected ZIP arrives from a stranger, which can stop scanners from reading it.
- A site asks you to paste a command you do not understand into Terminal. Find out what it does first, and never run one on instructions from someone who contacted you unexpectedly.
- Cracked or "free" copies of paid software, which are a common source of malware.
If you already ran something suspicious
Disconnect from the internet and run a full scan with Microsoft Defender. Malwarebytes can provide a second opinion. Then, from a different device you trust, change the passwords for your email and banking and turn on two-step login. If this is a work PC, tell your IT team straight away.
No check gives a complete guarantee. Together, though, they catch most of the fake downloads that ordinary people run into. To lower the risk further, you can install from the catalog using winget, which verifies each installer's fingerprint before it runs.
