Use Free OK — A verification checklist for free | usefreeok.com
The full pre-install verification procedure, from file type through signature and sandbox test, in the order that wastes the least time.
Checking a download is a sequence, not a single tool. The whole routine takes about fifteen minutes, and it is ordered cheapest-first: file type in seconds, checksum in about a minute, signature in about a minute, an online scan in a few minutes, and a sandbox run of five to ten minutes only for files that passed everything before it.
Start with the file type. Turn on real extensions, and treat any double extension such as invoice.pdf.exe as a program, because Windows executables begin with the magic bytes 4D 5A ("MZ") whatever the name claims. A file that lies about what it is has already failed.
Next, verify the SHA-256 checksum against the publisher's published value — an exact match across all 64 hexadecimal characters proves your copy is bit-for-bit what was released. The walkthrough in How to Verify a SHA-256 Checksum shows the compute-and-compare routine in detail.
On narrow screens, swipe or scroll the plate sideways.
Then read the signature. On Windows, File properties > Digital Signatures names the publisher and shows a certificate validity window, typically one to three years, that must still cover today's date. On macOS, Gatekeeper has required notarization since Catalina (10.15, 2019); right-click > Open bypasses that check rather than passing it.
For files under about 650 MB, a VirusTotal upload adds a per-engine detection count — a cluster of detections ends the check, while a single odd flag usually means a false positive worth a second look. Finally, run the app in a sandbox for five to ten minutes and inspect launch behaviour, browser extensions and startup entries for anything that persists uninvited.
None of this works well if the source gives you nothing to verify against. Where to Get Free Software Safely sets the criteria: published checksums, signed installers and package managers that print exact version strings like 1.2.3.
Further reading