64-bit
wixmachine scopedownload.calibre-ebook.com · publisher-owned- File name
- calibre-64bit-9.13.0.msi
- SHA-256
- f5f19e870163c20ec63a656d6f5d0c123e07c4254899380ebeec51b00766e615
by Kovid Goyal · GPL-3.0
calibre is the one stop solution to all your e-book needs.
These URLs are the ones Kovid Goyal declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what Kovid Goyal published. Delete it.
Windows · PowerShell
Get-FileHash "calibre-64bit-9.13.0.msi" -Algorithm SHA256macOS · Linux
shasum -a 256 "calibre-64bit-9.13.0.msi"Expected output
f5f19e870163c20ec63a656d6f5d0c123e07c4254899380ebeec51b00766e615
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
This installer is an MSI package, so it takes the standard Windows Installer switches. That is a property of MSI itself rather than something the publisher declared.
64-bit · machine scope · MSI convention
msiexec /i "calibre-64bit-9.13.0.msi" /qn /norestartRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on a domain owned by the publisherThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 0 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | GPL-3.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions calibre registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from calibre-ebook.com, which is a domain we have tied to Kovid Goyal.
The installer on this page comes with the SHA-256 Kovid Goyal declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id calibre.calibre --exactUpgrade later
winget upgrade --id calibre.calibreWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of calibre, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
F6456073BFCF37ADF6302FB4149FA8B4D798D411BC0DAFD99CB629A5006DCFA6
59BD2A7FB7978665E16B7F94218479D64DDEDC80EC7FCCB47A6768AE348CEB3D
8A69CCA7BE43E3BB0202C60BDBBF855E3614B2295B82F33A67D308EEC83D5255
75583C5D16E16D9D7BBFB8FBA89F94536A47618C525F34A4E80C00190FE9F4FB
4A223B127D97ABCDC9EDCB4DD908020F0B48A09F537237A97CA518B3B94D37AC
AB9F64AB8017872F086AF41BDCAE8055463B3408987A0F4945BD8C27C6A2EA00
A70EA776433A937260AE7317A9F292F148F7336E733DF156E646BD286B8CB855
A7D673927CDC6F39CC595BD5114B6D5A82889603DE962A83CC25CF7A13AB1810
AA6A25C3ABE4C07D8216EE8D5827B490B74DB6E5EBCD1A40F3F96FF3C7400AF7
F5D967ED123CDC24A802600BDBCF64B0D2E14379F2D6D46351DF2B2B5206713C
71F3C658E2BADCC6C6E0E835B776A0DB018AB954568E4515C8BCF78A523416CD
12E9190D2EE52A846C37827E7E1F525A7B43D2CF7B1F994C7631F147C04D0898
CF073687B146BA6C8532391E663A292C6FD43D9AFA264870834DF5A31C215C84
7BEF9101B1398A07274742E4CFB3AA7A7BFD60049C00641C6FA4610EC931B017
AF7C10CEB1558FBC686BF72894E10903E31851306BBF7052113B0A887299BBAF
7F052A6027D2331CE214CD4CBF7D8B12125B39A420309745CC6974CF3A000D50
188B6C8651A13FACB8A6208F4190771D43244E1838947737289B6EB157B831F1
242287677E29148448F44CEA5C3E5DCEFF2D6FBD569F24CDC5BF8F12D482C096
FCF1A8E3F0C4480A6423F70BC5AB0CAF7DBF4C99D5676D0E823D76E14BE8FCF7
61EFDDE89ED6E3CBE985E60B380772547754D943CFC10DD281B979A8DED87036
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every calibre version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Kovid Goyal and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to calibre — just other entries, each with its own official URL and published hash.