Is Ventoy Safe? The Binary Blob Debate, Secure Boot and How to Verify

Short answer: Is Ventoy safe? The official Ventoy, from ventoy.net or github.com/ventoy/Ventoy, is a widely used, GPL-licensed tool with no confirmed malware incident. The open question is trust in its build process. Since April 2024, users have asked the developer to remove prebuilt binary files (“blobs”) from the source tree. In May 2025 he published a list of them and their origins, but they are still there. Ventoy also skips Secure Boot checks by default. For a single Windows or Linux installer, Rufus is the simpler choice.

Where the real Ventoy lives

Ventoy’s README names https://www.ventoy.net as the official website, and the code lives at github.com/ventoy/Ventoy. The download page on ventoy.net says the site is underprovisioned. It sends you to SourceForge for the files and asks you to “remember to check the SHA-256 hash.” Each GitHub release carries the same files plus a sha256.txt. Those three places are the official sources. Any other “Ventoy download” site is a third party.

Ventoy turns a USB drive into a boot menu. You install it once, then copy ISO, WIM, IMG, VHD(x) or EFI files onto the drive and pick one at boot. The README says more than 1,300 ISO files have been tested.

The current release, checked

We read these values from GitHub’s releases API on September 26, 2026. They match the hashes and the July 24, 2026 date published in ventoy.net’s own download data. We downloaded the Windows ZIP and got the same hash.

The 1.1.17 changelog lists an “Optimization for Secure Boot process,” boot fixes for several distributions and a fix for a disk-write logic error.

Not code-signed. We checked Ventoy2Disk.exe from the official 1.1.17 ZIP. It has no Authenticode signature, so Windows cannot show a verified publisher. The SHA-256 hash is your integrity check. The main Ventoy2Disk.exe is a 32-bit x86 program. The ZIP’s altexe folder holds x64, ARM and ARM64 versions.

The binary blob concern, and what the developer did

This is the real reason people ask whether Ventoy is safe, so here is the record.

• April 3, 2024. Days after the xz-utils backdoor was discovered, a user opened issue #2795, “Remove BLOBs from the source tree.” The complaint: the repository contains many prebuilt binaries, such as dmsetup, veritysetup and FreeBSD modules, instead of building them from source in the release process. Prebuilt files cannot easily be audited, and xz had just shown how a hidden payload can ride along.
• May 7, 2025. About 13 months later, #2795 was closed and the developer opened issue #3224, “About the BLOBs in Ventoy.” He said some binaries come directly from other open-source projects and that he had been spending his limited time on features and bug fixes. He proposed building the blobs once through GitHub’s CI.
• May 2025 replies. He argued that files like BusyBox and 7-Zip are downloaded from their upstream projects, with the file hashes documented, so they can be checked. He called reproducible builds “very difficult in practice.” On May 14, 2025 he added BLOB_List.md to the repository, listing each binary and where it comes from or how to build it.
• Where it stands. When we checked on September 26, 2026, issue #3224 was still open. Community members had posted scripts and patches, including an unreviewed build patch in July 2026, but we found no release that replaces the blobs with binaries built by CI.

What this means for you: nobody has shown that a Ventoy release contains malicious code. The concern is that you have to trust the developer’s prebuilt pieces, because you cannot fully rebuild Ventoy from source yourself. For home use with ISOs from official sources, many people accept that. In an organization with a supply-chain policy, it may rule Ventoy out.

Secure Boot: supported, with a catch

Ventoy’s Secure Boot page says support has been on by default since version 1.0.76, with an option in Ventoy2Disk.exe (Option > Secure Boot Support).

• The first time a PC boots Ventoy with Secure Boot on, you must enroll Ventoy’s key through the MOK manager screen. It is a one-time step per computer.
• Recent versions use a new key. The Secure Boot page says that since 1.1.13 you must enroll a new key “for the UEFI CA 2023 issue.” The 1.1.16 release notes date the change to 1.1.14. Either way, if you updated from an older Ventoy, expect to enroll again. Ventoy documents how to delete the old key.
• The catch: the same page warns that Ventoy’s “default policy is fully bypass secure boot which means all EFI files can be booted without any check.” You can make Ventoy follow the normal UEFI Secure Boot policy through its Global Control Plugin.

In other words, once Ventoy’s key is enrolled, a Ventoy drive can boot unsigned EFI files on that PC by default. That is a deliberate convenience. Know about it before you enroll a key on a work machine.

Is Ventoy safe to download? How to verify it

1. Get it from an official source: the GitHub release page, SourceForge’s projects/ventoy, or links on ventoy.net.
2. Hash the file. In PowerShell:

   Get-FileHash .\ventoy-1.1.17-windows.zip -Algorithm SHA256

   Compare the result with sha256.txt on the GitHub release, the value on ventoy.net, or the table above. One different character means a different file.

3. Check the size. The 1.1.17 Windows ZIP is 16,650,853 bytes. An .exe “Ventoy installer” or a much bigger file did not come from this release.
4. Keep the drive current. Ventoy’s upgrade option keeps your files. Its install guide says “the upgrade operation is safe, all the files in the first partition will be unchanged.”

Our Ventoy download page lists the current hashes and links only to official files. Our fake download sites guide explains how lookalike sites work.

Ventoy or Rufus: who should use which

The two are not rivals so much as different jobs. The Rufus FAQ says multiboot is not planned for Rufus and names Ventoy among the tools to use if you want several ISOs on one drive.

Both tools erase the USB drive when you set it up. Ventoy’s guide warns that “the USB drive will be formatted and all the data will be lost after install.” See our Rufus page and the Rufus vs Flyoobe vs Media Creation Tool comparison if you are building Windows media.

Questions

Is Ventoy malware?

No malware has been confirmed in an official Ventoy release. The debate is about prebuilt binaries in the source tree that you cannot easily rebuild or audit.

Did the Ventoy developer respond to the blob issue?

Yes, in May 2025, about 13 months after it was raised. He opened issue #3224, explained where the binaries come from, and published BLOB_List.md. The issue was still open when we checked.

Is Ventoy open source?

It is licensed under GPL-3.0 and its source is public. Critics point out that parts of the build still depend on prebuilt binaries. The developer says they all have corresponding source code.

Does Ventoy work with Secure Boot?

Yes, since 1.0.76, after a one-time key enrollment on each PC. By default it then boots EFI files without signature checks unless you change its policy.

Why do I have to enroll a key again after updating?

Ventoy switched to a new Secure Boot key because of the UEFI CA 2023 change. Its documentation says to enroll the new key, and explains how to remove the old one.

Is Ventoy2Disk.exe signed?

No. We found no Authenticode signature on the 1.1.17 executable. Verify the ZIP’s SHA-256 hash instead.

Where is the official Ventoy download?

GitHub releases at github.com/ventoy/Ventoy and SourceForge’s projects/ventoy, both linked from ventoy.net.

Will Ventoy delete my files?

Installing Ventoy formats the USB drive. Updating an existing Ventoy drive keeps the files on it.

Can I install Ventoy with winget?

Yes. The Windows Package Manager community repository has a Ventoy.Ventoy package, which listed 1.1.17 when we checked.

Sources

• ventoy/Ventoy repository and README, GitHub
• Ventoy 1.1.17 release and 1.1.16 release notes, GitHub
• Ventoy download page, ventoy.net
• About Secure Boot in UEFI mode, ventoy.net
• Get started, ventoy.net
• Issue #2795: Remove BLOBs from the source tree, GitHub (April 3, 2024)
• Issue #3224: About the BLOBs in Ventoy, GitHub (May 7, 2025)
• BLOB_List.md, GitHub
• Rufus, rufus.ie, and the Rufus FAQ, GitHub
• Get-FileHash, Microsoft Learn