Use Free OK — A verification checklist for free | usefreeok.com
The criteria for choosing a download source: published checksums, signed installers, exact versions and an honest licence.
The source decides how much checking is even possible. A good source hands you reference values — a checksum to match, a signature to read, a version number to confirm — while a bad one hands you a wrapper and a promise.
First choice is the developer's own site, provided it publishes SHA-256 checksums and ships a signed installer. On Windows that means a publisher named under File properties > Digital Signatures with a certificate window, typically one to three years, that still covers today's date.
Package managers come next. The Windows Package Manager (winget) installs from published manifests and prints an exact version string such as 1.2.3 for each package, so you always know precisely what landed on the machine and can confirm it afterwards.
On narrow screens, swipe or scroll the plate sideways.
On a Mac, prefer notarized apps: Gatekeeper has required developer notarization since macOS 10.15 Catalina, released in 2019. Right-click > Open still launches an unnotarized app after a confirmation dialog, but that is a bypass of the check, not a pass.
Read the licence before the download button. Free trials typically expire after seven to thirty days; freeware carries no time limit but may lock features behind a paid tier. Both are legitimate — the failure is discovering which one you installed after the fact.
Whatever the source, run the file through the five-step routine in How to Check a Download Before Installing, and verify the hash as described in How to Verify a SHA-256 Checksum whenever a value is published.
Further reading