Download sources
Are software download sites safe?
Mostly the wrong question. What matters is whether the file you ended up with is the one the publisher built, and that is something you can check yourself in about ten seconds, whatever site you got it from.
The old reputation is out of date
For years the standard advice was that these sites wrapped installers in their own downloader and pushed toolbars and bundled offers alongside it. That was a real practice and it earned the reputation, but it is largely history: Softonic discontinued its downloader, and the major sites now serve files directly and run them through malware scanners.
Repeating the old warnings as if nothing had changed is inaccurate, and you will find plenty of pages doing exactly that. Many of them are published by VPN and antivirus vendors with something to sell you, which is worth noticing when you read their verdict.
What has not changed
Three things are true of any intermediary, however well run, and they are the ones worth your attention.
- You cannot verify the build.The publisher declares a SHA-256 for the installer they shipped. A site re-hosting that file does not republish it, so there is nothing to compare against. Passing a virus scan is not the same thing: it shows no known malware was detected, not that the file is the publisher's.
- Versions lag.An intermediary's copy is a snapshot. When it is weeks behind, you install a build with patched vulnerabilities still in it, and nothing on the page tells you.
- Ads look like download buttons. This is the one that still catches people, and it is a property of ad-supported pages rather than of any particular site. The large green button is frequently not the file you came for.
How to check what you downloaded
Hash the file and compare. If the result matches what the publisher declared, the file is byte-for-byte theirs no matter which site handed it to you. If it does not match, you have your answer without needing anyone's opinion.
Windows · PowerShell
Get-FileHash .\installer.exe -Algorithm SHA256macOS · Linux
shasum -a 256 installer.exePaste the result into the hash checker and it will tell you which program and version it belongs to, matched against 216 programs and their past releases. Nothing leaves your browser.
Or skip the middle step
The reason to use an intermediary at all is usually that the publisher's download page is hard to navigate, hides the offline installer, or has gone away. That is a real problem and it is the one this site solves: we publish the URL the publisher declared in their own manifest, with the hash, and we host nothing.
Looking for a single missing library rather than a program? That is a different question with a different answer, and downloading the file on its own is the wrong fix there: why you should not download individual DLL files.
Browse the 216 programs we indexHow each source is scoredThe hash archive as a dataset
Questions
Is Softonic safe?
The bundled-toolbar reputation it earned years ago no longer reflects how it works: the downloader that caused it was discontinued and files are served directly and scanned. The limitation that remains is structural rather than specific to them. Like any intermediary, it cannot give you the SHA-256 the publisher declared, so you cannot confirm the file is the publisher’s build. Hash what you downloaded and check it.
Is Softpedia safe?
Softpedia has a long-standing reputation for clean, unwrapped downloads and editorial checks. The same caveat applies as to every intermediary: the copy can lag behind the publisher’s current release, and the hash you would need to verify the build is not the publisher’s. Checking the hash settles it in seconds.
Which download site is the safest?
The publisher’s own site, every time, because it is the only source where the file and the hash come from the same place. Where a publisher makes that difficult, the next best thing is a source that publishes the publisher’s URL and hash rather than re-hosting the file, which is what this site does.
A download site says the file passed a virus scan. Is that enough?
It tells you no known malware was detected, which is useful and not the same as knowing the file is the one the publisher built. A tampered installer signed with a clean payload, or simply an outdated build with unpatched vulnerabilities, passes that check comfortably.
How do I know the download button is the real one?
On ad-supported pages you often cannot tell by looking, which is why the safest habit is to hash the file after downloading rather than to judge the button before. If the hash does not match anything the publisher declared, you clicked the wrong thing.