64-bit
exemachine scopedeveloper.download.nvidia.com · publisher domain- File name
- cuda_13.3.1_windows.exe
- SHA-256
- d68839fcce644576f0a1c6b066e0c5bc146a62db2fcac9fc6b4e6418e7ec533f
- Silent install
- -y -gm2 -s -n
by NVIDIA Corporation · Proprietary
CUDA is a parallel computing platform and programming model developed by NVIDIA for general computing on graphical processing units (GPUs).
These URLs are the ones NVIDIA Corporation declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what NVIDIA Corporation published. Delete it.
Windows · PowerShell
Get-FileHash "cuda_13.3.1_windows.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "cuda_13.3.1_windows.exe"Expected output
d68839fcce644576f0a1c6b066e0c5bc146a62db2fcac9fc6b4e6418e7ec533f
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The unattended switch below is the one NVIDIA Corporation declares in the installer manifest, not one we guessed by trying flags.
64-bit · machine scope · publisher-declared
.\cuda_13.3.1_windows.exe -y -gm2 -s -nRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Licence declared | ProprietaryA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Yes, in the sense we can actually verify: the installer downloads from nvidia.com, which is a domain we have tied to NVIDIA Corporation.
The installer on this page comes with the SHA-256 NVIDIA Corporation declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Nvidia.CUDA --exactUpgrade later
winget upgrade --id Nvidia.CUDAWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of NVIDIA CUDA Toolkit, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
378F7C46E4617175A4315639D570B4417F4E5EE8F5A90DFB0BC68ADD1347AFDC
FAC061CA18C1F2DDBEFBE2FD8E2F67353EA8F28DEA2C064A3EDEFE3B42905D2C
FB94566B3AC6F825E5FA84729D523D9F7BD445033E013928EE84B6CE04D55076
F0CA7CC7B4CEA2FAC2C4951819D2A9CAEA31E04000E9110E2048719525F8EA0E
19392BBFFD0AD4EE7CB295A181E87F682187F17653679C1C548C263B7E1CD9A6
D73E937C75AAA8114DA3AFF4EEE96F9CAE03D4B9D70A30B962CCF3C9B4D7A8E1
32E2400C86AFF1AE19716074F9B7263EBB7A4A5CD49CAB5DC029174F50898B3F
7D20C5EB186E4D3C64680FE5096BED05926AEA89754192102323C956C26244DE
3A4B476E1CD70EAABE42881B480F48557481D1EDE0AB5F33B2AF11B8903425B8
D4828F42152CCFB6B998A96533C5DD5ECC0409C09B46BBFF787B6E32A31D1B0D
7E4E2725234C92EDC1753F1BB603D3AB31FE8481189022402C0C8B9188B38B25
C4CF6CCD83BC4D75017525D01CA2F78D39AD427E465DC0E3B82948EA5BBEB034
B70F38F27321C0A53993438A91970A2E3C426F46DA4C42ECEFF1EEEA031A6555
22D6899B2D8851E7DB54BDEA201B280C544D0C1867DA0128A659E2A223BC36C2
5CC73D14E9FB0134CFCAB08CC9E43226051C70416CDDB61A2C660194B61F71D6
538CDA98841F8F9BA704682253562138C3D455FAE49610C9625E0DFF6B91807E
FF5BEED6004E968DD413200535168559E90D7D870E8CF7189786CD32CD78CF01
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every NVIDIA CUDA Toolkit version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories NVIDIA Corporation and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to NVIDIA CUDA Toolkit — just other entries, each with its own official URL and published hash.