How to verify a download before you run it

Updated November 4, 2026

Admin tools run with high privileges on corporate networks, which makes them a favourite target for impersonation. Fake download sites and tampered installers are common, and search results and ads can both lead to them. These checks take about a minute. Do them on updates too.

Four checks before you run a file

  1. The address is exactly right. The address bar shows the developer’s own domain over HTTPS. Watch for hyphenated look-alikes, a different top-level domain, and download portals that wrap the file in their own installer. If you reached the page from an ad, type the address yourself instead.
  2. The size looks like a real program. A very small “download manager” that fetches the program afterwards is not the program. Close it and delete it.
  3. The digital signature is valid. On Windows, right-click the file, then open Properties and Digital Signatures. The signer should be the developer. A missing signature tab usually means the file is unsigned, so check whether the developer normally signs its releases.
  4. The hash matches, where one is published. Compare the SHA-256 value on the developer’s site with the file you downloaded.

A legitimate installer never needs you to disable your antivirus, and it should not push a bundled toolbar or offer. If either happens, delete the file.

Verify from PowerShell

Get-AuthenticodeSignature .\installer.exe | Select-Object Status, SignerCertificate
# Status should read: Valid

Get-FileHash .\installer.exe -Algorithm SHA256
# Compare the value with the one the developer publishes

Verify on Linux or macOS

sha256sum installer.tar.gz          # Linux
shasum -a 256 installer.dmg         # macOS

Where the project publishes GPG signatures, check those as well. A signature proves more than a hash published on the same server as the file.

Why antivirus sometimes flags a network scanner

Discovery tools are dual-use, so some security products label them “potentially unwanted” because of what they can do, not because malware was found in the file. Check the signature first. If your organisation’s policy blocks scanners, follow it and ask for an approved exception rather than quietly adding an exclusion.

Scan only networks and hosts you own or have written permission to assess. Our authorization checklist covers how to get that permission in order.

If you already ran a suspicious file

Disconnect the machine from the network and tell whoever handles security in your organisation. Don’t rely on uninstalling the program. Assume any credentials used on that machine are exposed, and change them from a different, clean device.