32-bit
exeuser scopegithub.com · publisher domain- File name
- AutoHotkey_2.0.26_setup.exe
- SHA-256
- 2bf1b89b1047136490fc321d2fdc988b42dd86f693eea7872746ac6adf722bc3
- Silent install
- /silent
by AutoHotkey Foundation LLC · GPL-2.0
Macro-creation and automation-oriented scripting utility for Windows.
These URLs are the ones AutoHotkey Foundation LLC declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what AutoHotkey Foundation LLC published. Delete it.
Windows · PowerShell
Get-FileHash "AutoHotkey_2.0.26_setup.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "AutoHotkey_2.0.26_setup.exe"Expected output
2bf1b89b1047136490fc321d2fdc988b42dd86f693eea7872746ac6adf722bc3
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The unattended switch below is the one AutoHotkey Foundation LLC declares in the installer manifest, not one we guessed by trying flags.
32-bit · user scope · publisher-declared
.\AutoHotkey_2.0.26_setup.exe /silentRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 2 of 2 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 2 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 2 of 2 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 4 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | GPL-2.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions AutoHotkey registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from github.com, which is a domain we have tied to AutoHotkey Foundation LLC.
Every one of the 2 installers on this page comes with the SHA-256 AutoHotkey Foundation LLC declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id AutoHotkey.AutoHotkey --exactUpgrade later
winget upgrade --id AutoHotkey.AutoHotkeyWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of AutoHotkey, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
A945F745506CF93E41C1FCA2006D1F2FE39E07355F37CA357F90F74CCA8A61D4
D7038E9BA08E9C63EDCDB2E63552B434B87491B449D7082CF28A40CD4ECE91AF
5613E65158AB8A8A90D5986B18894080AF367DC36347B366EE3AEB0DBCD6DB86
CA4247B757AB19DBF7A4BA5CFAB69B0EBCA60FB4F46E73389E5B9EA9A1CD7C7B
7F70BAC4DBA20AA55C12E59A7BBDEC748601AF864D47C3EE892635216B76F89E
FD55129CBD356F49D2151E0A8B9662D90D2DBBB9579CC2410FDE38DF94787A3A
A30AF310F45D4076CF1580BB08015DB9A1337DDC1A99CF61829E645B196E8B2E
69B21D5A3D2BCC2B2B075D275A38F551997C45F28C9504995EDE406AA101BEAD
F5D2887ADEAA87F28D30174552B1EC976D302E7C804FAA3E8CE74DDB0DDA6C78
207FEA03708F1BA8C8E61F30170D799495736726D1853D7D4150A5FFFFA14013
4E1E3123DD85D3AC65A0803B08DD89B9B12B5A00B9F566782855332D03E5FE26
510A833BDD0F896CC398EAAE4FF475F5B7CFE37649EFBF647B50D21E442394B9
2CD1B00947ABE2DF2CBA3997D7BDD5A9043EBE598987F0E9CADE0ACEB73F9EDD
8F0DDF90F4CC44499BBEB0F2D3FF298CD5E5D206CA759535495EE767E83B6023
2F58A372DC62E70149BD29621CB76049C438204127426299B9A8BDCFF002C23A
A6E07CCCC0D66A5894500A057FE92440F1E372BDA4856F148244BA369BF521DE
2DF6D9782B8656772C842C22B6582EE91782BDE800F345491A71EB72C294E6FC
F815E34B79E1357B7DEFC86D467077293F56B4CAC373394C01A66ADABACF3350
38B5790E1FD1BEA17231A3A55E701217EBDE42428046E029F609B1D1734C7140
A32362B2769CB3CD8CAA10722C50208B7170FE82D3663E85425DF416422B4D22
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every AutoHotkey version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories AutoHotkey Foundation LLC and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to AutoHotkey — just other entries, each with its own official URL and published hash.