Check before you install
A short, repeatable procedure you run on any free download: confirm the file type, match the checksum, read the signature, scan the file, then smoke-test it in a sandbox before installing.
Not a download host, not an antivirus product review, and not a guarantee — it cannot make an unsafe file safe, only catch the known warning signs before installation.
Run the cheapest checks first and stop at the first failure — the whole routine takes about fifteen minutes.
The order is deliberate. Confirming a file type takes seconds, a checksum about a minute, a signature about a minute, an online scan a few minutes, and a sandbox run five to ten minutes. You spend the most time only on files that have already passed everything cheaper.
Each step has a named failure, and each failure has the same response: stop, delete the file, and look for a better source rather than searching for a way around the warning.
A SHA-256 checksum is a 64-character fingerprint, and the publisher's published copy of it is your reference.
A SHA-256 digest is exactly 64 hexadecimal characters. Because changing a single byte of the file changes the whole digest, an exact match means your copy is bit-for-bit what the publisher released.
Compute the hash of your download, place it next to the value published on the download page, and compare all 64 characters. A mismatch — even in one character — means the file is corrupt, repackaged or tampered with, and it goes in the bin.
A match proves only that the file is identical to what was published; it says nothing about whether the publisher deserves trust. That is what the signature and sandbox steps are for.
| Check | What you look at | Pass mark | Time it takes |
|---|---|---|---|
| File type | Real extension and the file's first bytes | No hidden .exe; programs start with 4D 5A ("MZ") | Seconds |
| SHA-256 checksum | Your hash vs the publisher's published value | Exact match across all 64 hex characters | About 1 minute |
| Digital signature | Publisher name and certificate dates in Digital Signatures | Certificate valid today; typical window 1-3 years | About 1 minute |
| Online scan | VirusTotal report, files up to about 650 MB | 0 detections across engines | 2-5 minutes |
| Sandbox run | Launch behaviour, browser extensions, startup entries | Nothing unwanted persists after the test | 5-10 minutes |
| Licence terms | Freeware vs free trial | No surprise 7-30 day expiry after install | Read before downloading |
The signature tells you who released the installer; the file type tells you what it actually is.
On Windows, an Authenticode-signed installer names its publisher under File properties > Digital Signatures. Signing certificates typically carry a validity window of one to three years, and that window must still cover today's date — an expired certificate is a failed check, not a technicality.
File names lie more easily than file bytes. Windows executables begin with the two magic bytes 4D 5A — the letters "MZ" — so a file called invoice.pdf.exe is a program whatever its icon suggests. Turn on real file extensions before judging any download by its name.
On a Mac, Gatekeeper has required developer notarization since macOS 10.15 Catalina, released in 2019. Right-click > Open will still start an unnotarized app after a confirmation dialog — that is a bypass of the check, not a pass.
The figures on this page — 64 characters, 650 MB, 1-3 year certificate windows, 7-30 day trials — come from the published documentation of the tools named in each step.