Dataset

The installer hash archive

Every SHA-256 hash we hold, paired with the exact URL the publisher declared for that build. It covers current releases and older versions, and it is free to download and use for anything.

9,590

hashes

177

programs

9,171

past builds

30 Jul 2026

last built

Why this exists

Publishers hash their installers and then publish the hash somewhere that disappears with the next release. A year later you have a file on a share, a server or a USB stick, and no way to tell whether it is what they built.

Meanwhile the sites that do keep old installers around keep the binaries, re-hosted on their own servers, which is the exact thing you cannot verify. We keep the opposite: no files, only the hash and the original URL. That is enough to answer the question, and it carries none of the risk.

What is in a row

Nine columns, one row per unique hash. Here is a real one:

sha256

6745fa76dc2ea031596d8678f6f6b99c3c1b435b4164a63485adbbc7b8d82ef0

file

7z2602-x64.exe

program

7-Zip

slug

7zip

version

26.02

arch

x64

url

https://github.com/ip7z/7zip/releases/download/26.02/7z2602-x64.exe

publisher

Igor Pavlov

current

true

Using it

Hash a file you already have and look the result up in the archive. If it is there, you know which program, which version and which official URL it came from.

$h = (Get-FileHash .\installer.exe -Algorithm SHA256).Hash.ToLower()
(Invoke-RestMethod https://file.wiki/data/hashes.json).rows |
  Where-Object sha256 -eq $h

h=$(shasum -a 256 installer.exe | cut -d' ' -f1)
curl -s https://file.wiki/data/hashes.csv | grep -i "^$h,"

For a one-off check there is no need to download anything: paste the hash into the hash checker and it resolves in the browser.

Where the data comes from, and what it is not

• Source. Publisher-maintained manifests in the public microsoft/winget-pkgs repository. We read them, we do not compute hashes ourselves, and we do not host a single installer.
• A hash is not a verdict. A match proves the file is byte-for-byte what the publisher declared. It says nothing about whether that software is any good, or safe, or something you want.
• Absence proves nothing either. We index 177 programs, a small slice of the software that exists. A hash we do not have is a hash we cannot speak to.
• Old URLs die. Publishers pull old builds without warning. The link may 404 while the hash stays correct forever, which is the whole point of keeping the hash.
• Licence. CC0. Take it, ship it, build on it. A link back is appreciated and not required.

How the rest of the site is verified