Search for a client by name and the first page of results will always include a few sites that are not the project. Some are harmless re-uploads, some hand you an installer with extra things bundled in. And this is not an ordinary application: by design it stands in front of your network traffic, so a tampered build sees everything. That asymmetry is the entire reason five minutes here is worth spending.

Source first — it outranks every step below

  • What to trust: the project's own code repository and its releases page, where files are listed as attachments under a version tag.
  • What not to trust: download portals, cloud-drive re-uploads, forum attachments, and the paid search result sitting above the real one.
  • This site is an information site, nothing more. Every download route listed here leads back to the project's own release page, and that page is the authority — not this one.
  • Anything calling itself an official mirror, an accelerated build, or a preconfigured edition is a reason to leave, not a convenience.

Landing on the right page comes down to the account and repository name in the address, not to whether the page looks familiar — copying a layout costs nothing. Spend a couple of seconds on the first visit confirming the owner and the repository, then bookmark it and use the bookmark from then on. That habit removes the search engine from the chain entirely, and most of the risk lives there.

SponsoredWhere does the subscription link come from?Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click.Get high-speed nodes

Check the file before you check the hash

  • Architecture. x64 against arm64 on Windows and Linux, Intel against Apple Silicon on macOS. The wrong one either refuses to launch or limps along through a translation layer.
  • Extension. .exe or .msi on Windows, .dmg or .pkg on macOS, .AppImage or a distro package on Linux, .apk on Android. Which packaging format suits you is a separate discussion; here you are only confirming you downloaded the thing you meant to.
  • Size. Compare it with the figure printed next to that asset on the release page. A few kilobytes of difference is nothing; a few megabytes is worth stopping for.

Compute the hash

certutil -hashfile installer.exe SHA256
Get-FileHash .\installer.exe -Algorithm SHA256
shasum -a 256 app.dmg
sha256sum app.AppImage

The first two are Windows and either will do — certutil is on every installation, Get-FileHash is the PowerShell way. The third is macOS, the fourth Linux. Compare the output with the value on the release page. Read the whole string, not just the first and last few characters: anyone capable of substituting a build is capable of producing a hash whose opening digits look familiar. Case does not matter, so a lowercase result against an uppercase published value is fine.

When the release page publishes no hash at all

That is common, and there is a fallback. On Windows, right-click the file, open Properties, and look for a Digital Signatures tab. If it is there, open the signer details and ask yourself whether that name is the entity you expected. No tab at all means the build is unsigned — normal for small open-source projects and not a warning sign in itself, it simply means this check gives you nothing here. On macOS the equivalent is a command.

codesign -dv --verbose=4 /Applications/YourApp.app
gpg --import publisher-key.asc
gpg --verify app.AppImage.asc app.AppImage

The first line prints the signing identity of an installed application. The other two apply when the release page ships a .asc or .sig next to the binary: import the publisher's public key, then verify. Be honest with yourself about what that proves. The signature only shows the file matches the key you imported; if you fetched that key from the same page a fake would have served you, nothing anchors the chain. Get the key through an independent route, or accept that the step is weaker than it looks. A GPG signature and a code signature are both better than nothing, and neither is proof.

One more thing that is not evidence in either direction: your antivirus. Tools that rewrite network settings and install virtual adapters trip heuristic detection constantly, so a warning on an honest build means very little. The reverse says little too — a freshly tampered build has no signature to match yet. Decide on source and hash. Do not let the scanner decide for you.

Write down which version you installed. When a later release breaks something you rely on, rolling back depends on knowing exactly which build you were on — and six months later a release page is full of tags that all look the same.