Do Windows Apps Publish Checksums? We Checked 25 Official Installers

Short answer: Not always. On 17 October 2026 we downloaded the official Windows installers of 25 popular programs and checked two things: whether the publisher lists a checksum for the file, and whether Windows sees a valid digital signature. 17 of the 25 publishers listed a checksum, and 13 of those were SHA-256. 19 of the 25 installers had a valid signature. Every program had at least one of the two, but the split was clear. Big commercial apps such as Chrome, Discord, Slack, Spotify and Teams sign their installers but publish no checksum. Several open-source projects, including Kodi, digiKam, OpenSCAD and Scribus, publish a checksum but do not sign. So the right check depends on the program.

Official-source review and file check — 17 and 18 October 2026 UTC: We downloaded each installer from the publisher’s own download page or download server, onto a separate folder on a Windows 11 PC. We measured its size and hashes, read its Authenticode signature with Windows’ own Get-AuthenticodeSignature, then deleted it. We compared the hash with the value the publisher lists, where one exists, and linked that source below. We did not run, install or scan any of the installers. A matching hash shows the file is the publisher’s release; it is not a malware test.

Why these two checks matter

A checksum (usually SHA-256) lets you prove the file you downloaded is byte-for-byte the file the publisher released. It only helps if the publisher lists the value on its own site. A digital signature tells you which company or person signed the file, and Windows shows that name before it runs an installer. Fake download sites usually fail both: their files do not match the published hash, and they are unsigned or signed by an unrelated name. Our guide to spotting fake download sites covers the site side. This study looks at what the real publishers give you to check the file itself.

The results: 25 official installers

Every hash the publisher listed matched the file we downloaded. Each program’s page on this site shows the full SHA-256 we measured, so you can compare your own copy with our SHA-256 checker.

What we found

1. Commercial apps sign, but rarely publish a checksum

Chrome, Discord, Slack, Spotify, Teams, PotPlayer, FastStone and foobar2000 list no checksum anywhere we could find. All eight installers carried a valid signature from the company behind them. For these programs, the signature is the only check you have, so read it before you run the file. Our guide to checking an installer’s digital signature shows where to look.

Two of these were very small online installers: Spotify’s was about 1 MB and Teams’ bootstrapper about 2 MB. They download the real program during setup, so the file you check is only the first step.

Edge is the exception among the big names. Microsoft lists a SHA-256 for its Edge for Business MSIs in its public update feed, and our file matched it. That feed covers the full offline MSI, not the small installer on the consumer download page.

2. Several open-source projects publish a checksum but do not sign

Kodi, digiKam, OpenSCAD, Scribus and the K-Lite Codec Pack installers had no Authenticode signature, so Windows shows “Unknown publisher” for them. That does not mean the files are fake. All five matched the hash their publisher lists. For these programs, the hash is the check that matters, and a signature is not something to expect.

Inkscape is a middle case. Its installer carries a signature, but Windows could not verify the certificate chain on our PC (status UnknownError). Its SHA-256 matched.

3. Not every checksum is SHA-256

13 publishers list SHA-256. Signal lists SHA-512 in base64 form inside its update feed, which is strong but needs one extra step to compare. Plex lists only SHA-1, and Scribus and Sweet Home 3D have only the MD5 that SourceForge shows. SHA-1 and MD5 still catch a corrupted or swapped download from an ordinary fake site, but neither is considered collision-resistant any more. With those programs, check the signature as well where there is one.

4. Every program gave at least one check

None of the 25 installers was both unsigned and without a published hash. In practice, that means you can always verify one of these programs if you download it from the official source. If a file you got elsewhere has no signature and does not match the publisher’s hash, do not run it.

Which check to use for which program

To get a file’s SHA-256 in PowerShell, run Get-FileHash .\file.exe -Algorithm SHA256. To read the signature, run Get-AuthenticodeSignature .\file.exe, or open the file’s Properties and the Digital Signatures tab.

Limits of this study

• We checked one build per program, on one day (17 October 2026 UTC). New releases change the hashes, and some publishers may add or drop checksums later.
• “None published” means we found no checksum on the official download page or download server. If a publisher lists one somewhere we missed, tell us and we will correct the table.
• The signature results come from Windows on our test PC. A different PC with different root certificates can report a different status, as Inkscape’s result shows.
• For Chrome we checked the offline installer, and for Edge the Business MSI. The small installers on their consumer pages are different files.
• We did not run any installer or scan it for malware.

Questions

Is an unsigned installer always unsafe?

No. In this study, five genuine open-source installers were unsigned. Check them against the publisher’s published hash instead, and download them only from the project’s own site.

Is a valid signature enough?

For programs that publish no checksum, it is the best check available, as long as the signer is the company you expect. Malware is sometimes signed with a stolen or unrelated certificate, so check the name, not just the word “valid”.

Why don’t Chrome, Discord or Spotify publish a checksum?

We found no explanation on their download pages. What we can say is that all of them sign their installers, so the signature is the check to use. We report only what we found.

Where can I see the full hashes?

Each program’s page on this site, linked in the table, lists the SHA-256 we measured and the publisher’s source. The same data is in our open dataset on GitHub, official-download-sources.

Sources

• Mozilla: Firefox 158.0 SHA256SUMS
• Microsoft: Edge update feed (products API)
• The Document Foundation: LibreOffice 26.8.1 MSI mirror list with hashes
• GIMP downloads page
• Inkscape 1.4.4 x64 installer SHA-256
• KDE: Krita 5.3.4.1 mirror list with hashes
• KDE: Kdenlive 26.08.2 mirror list with hashes
• KDE: digiKam 9.1.0 mirror list with hashes
• Scribus 1.6.6 files on SourceForge
• Sweet Home 3D 7.5 files on SourceForge
• OpenSCAD 2021.01 installer SHA-256
• XnView MP checksums
• Kodi 21.3 mirror list with hashes
• Plex downloads API (SHA-1)
• Codec Guide: K-Lite Codec Pack Standard download page
• AIMP download page
• Signal Desktop update feed (SHA-512)
• Microsoft Learn: Get-FileHash
• Microsoft Learn: Get-AuthenticodeSignature