64-bit
exeuser scopedesktop.githubusercontent.com · known platform- File name
- GitHubDesktopSetup-x64.exe
- SHA-256
- 436b928ccef4729b0e37ffcab4cfe3b64662895a3003fd1535aca3301a51dc4a
- Silent install
- --silent
- Product code
- GitHubDesktop
by GitHub, Inc. · MIT
Focus on what matters instead of fighting with Git.
These URLs are the ones GitHub, Inc. declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what GitHub, Inc. published. Delete it.
Windows · PowerShell
Get-FileHash "GitHubDesktopSetup-x64.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "GitHubDesktopSetup-x64.exe"Expected output
436b928ccef4729b0e37ffcab4cfe3b64662895a3003fd1535aca3301a51dc4a
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The unattended switch below is the one GitHub, Inc. declares in the installer manifest, not one we guessed by trying flags.
64-bit · user scope · publisher-declared
.\GitHubDesktopSetup-x64.exe --silent64-bit · machine scope · MSI convention
msiexec /i "GitHubDesktopSetup-x64.msi" /qn /norestartARM64 · user scope · publisher-declared
.\GitHubDesktopSetup-arm64.exe --silentARM64 · machine scope · MSI convention
msiexec /i "GitHubDesktopSetup-arm64.msi" /qn /norestartRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
Silent install commands for every program we index · silent uninstall
Every guide on this tells you to hunt for the product code with Get-WmiObject or in the registry. You do not need to: it is published in the installer manifest, and it is printed below.
Product code · 64-bit
{6F099A2E-163A-4DA1-AC84-DBCFC0719B6C}
Uninstall, with the usual prompts
msiexec /x {6F099A2E-163A-4DA1-AC84-DBCFC0719B6C}Silent, for deployment
msiexec /x {6F099A2E-163A-4DA1-AC84-DBCFC0719B6C} /qn /norestartProduct code · ARM64
{1EC44048-BC33-4F5D-8989-C77DDDCB95D8}
Uninstall, with the usual prompts
msiexec /x {1EC44048-BC33-4F5D-8989-C77DDDCB95D8}Silent, for deployment
msiexec /x {1EC44048-BC33-4F5D-8989-C77DDDCB95D8} /qn /norestartThe codes above belong to GitHub Desktop 3.6.4, the version in our index. If you have an older release installed, its code is different and this command will report that the product is not installed. In that case run Get-Package -Name "GitHub*" in PowerShell to read the code of what you actually have.
This removes the program as the publisher packaged it. Settings and files created after installation, typically under AppData, are deliberately left behind by the uninstaller and have to be deleted by hand if you want them gone.
Reinstalling and hitting error 1638? That is this same product code, and the command above is the fix.
Product codes for every program we index, with the msiexec switches and how to read the code off your own machine.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 4 of 4 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 4 on a recognised distribution platformThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 29.8 / 35 |
| Served over HTTPS | 4 of 4 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 0 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | MITA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
The installer comes from a recognised distribution platform rather than GitHub, Inc's own domain. That is normal for this kind of software and not a red flag by itself.
Every one of the 4 installers on this page comes with the SHA-256 GitHub, Inc declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 95/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id GitHub.GitHubDesktop --exactUpgrade later
winget upgrade --id GitHub.GitHubDesktopWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of GitHub Desktop, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
71E939B98B8BDD77B8178362399D5A6A49BC24D8CF7882F4AB1030BE3E14D435
62613AF0723746130D17E415175A9C312929A06CE232EC34DA476912CC2E11C3
5B79429C8B43A2AA722A82241E3391F8D14F9EC118F2861D9A98180B8914041B
A69C53BCD4BDDF02E981DD3EFC40B2D6D760ADC4282A2DCE2300C3DB0B2B9E3A
DEAC92B3AD54074D02BF8D9B94681B00D52B981605D448068F21D8A8BE962880
36A7A7FAF601F0726214D14DDAAF2EA9AE1C39D3526B1F4B7C8C432FD8E770B8
B7B3B13273E565DEDC53025AAB5522592458672405AA738389679CBE644D8BD3
8608EAE0C71BDFAEC3D72F5D711CB841BF43C558606163470DD79FC08FBE0875
2E0A3519BA3D4BDBB7CBDEC0E2605535E78CB81F4051E3C963CF3A613AF5EBCA
767C25ADDC1E75D1FBAA235055A4C45172DCB82056327C710E5314537F210B61
EBC9E15855D67BEB3856E8BFF3E0308A14A4416D66C53E41D6E3F02E36913794
A6BDBA0A2F50CC0FB78A5C98A4A8734E9BFA5DACA9B67EEE88356A2CE09418C3
56C1B848A736F9C076FB440B29D5A968FD82986FFE6FF715CB0C761C9A52F4A7
274DD0D450A7B414DF097BF127C4701D94BE2E1D405CE42B183307CAA9EF769E
C2DD6A8FF4D9D0C11F09A6B2C5DDB86FD8E62C9766E24C6F6EB7C727551B802E
28D5D538B450CC5E4FA9C35AB6AFD3FAAF7033A0C161A72015D873803CA5F59F
338E6FE3430DDB7DB3E370F11B98E2D6A25998D5D7BDC7D714B77CFB5B13AFC0
33658FEF56AB64D7650CA625F19ABA9B027C4D69A1CC8BF1E695695EBD68602E
BEDF3558FE5F01F64A29637256456C8C16CEB29FF11951CA4774B405E6B7BF2D
7C936706036842E27C5AE5D714F80B8BDDC05C4B4BB9B4A59169A182EA2A148A
7C00CB4C812DE6E10CB5A83336E93E40E29D5417D11B80CA2631B8A1DDA59D7A
21254ECCADA7F7496EC5804A0E4310A17BDD9797B01FDA53469B6D46445DCCA0
352AF4D6FF1DFA2BEC1881899B250BE0908FBBBC0E99EB5ED354233070AFCB4F
4DA48D96B0AE4DF0AD3B2BB7121BD267032DBE1191932D368E46F90A4FC18BF0
7B6D44F87B619FD78C016DB6A783CAD52F44A060912AD853F00353A9152853D9
15D72D9FA7B412D56181F3CE59BD8389E7A57BADFCC1B6F577608C07301D30EC
53A92674FD2F696F12140651C3D3C25B18D20BE822829C34EC3F9528FC48C931
94FC391130EDC8218AE84231440014C3779C2323D3AFE8D77015D3D0606878B6
B1059918F7C62F30941CB7E0DFCA82D4B318AC4E41F0D3732244E3E8F94BE7A0
B3D10EF725512FBC03A2E153001ADE85034607E9F9A181E2CD0027CC01AB8480
25C6913AA0925B22276355277395D4B6AB6F1A1B781219C59A25A8A7BFC4C07D
0EA81C3386232AD0F1AC4D05CEAF6FD3FA1374C2B55B6B273D0FA5307794892B
782BFC0D239258339499C40579EC2B9C9A2C1B93C1F57751F1A492D1D54A94A5
90FC7236F06E1888C378ACD9B92FB411732508632306627AEDC59559D5255027
826FF0244DC75AEC6761314536CA047634C80C269FDE0C90DB0779D4D55DBEDE
E1C643C09BD0C0F5B154A761C0FF7C270F65BC4E2CB0BE146100748AB3EC7548
8562AE4128FF17FA0848D9E57B05681B3C3EB4C85A694ED75D39CBA17A8370DF
CB4C566B9C77E51DF13F2469E4554F36C2164F47FDE2525E0FBC0498806BE7C9
7C00CB352DA1C711E5D9076F8DC6E38F07E96446496C90E4A6939AC00529F4A1
735C9254329BF05F96AA5F47182FC0546DD9E4C07F59EC8CA085F44B3D3C10D9
885787059E225A4594459EA7EC1339F1A27D08EBCE118B095E9F0E9371AB3385
BB2B5EF2257EC7C37033262AB236C44D972B9F67E0B1562C5A38E1E3C499B27D
9A57660E10A56261E2E606207CD5D5893CA8D5DF37426007F59F57093FA106B6
4C722B5444911CED54B3381E39FC7D17AB719D1A0417BD78CE8ADB74CAA15C62
ED805E0B0C36D4BBEE71E6FB4E284B01AEEB4F5A0966F8D26307754F3712A0B0
D8FA3446113230637927DC70E8E0F4F6CD54332177586670F92D8AA1B148DA13
C13F51F3DFA62F2C39070B72A77C8C26AB429679E187837D115831F0C57984DC
7BA6A15DC281765DE490718BACB1F4CF91514330D0BE863F3C7F32E31AE5EB4C
072DD05B67B3A17A9CE75686E7A8FE0CB5CF284CBB539070DDF75F719332F2BA
ECF65CB2074B5B4BE2F1C7E087DE7551D38D57FDEFC68A6C0697E708D6CF8EAB
B8E614E78E32383C3F930C685470FA8D92324399EF3B10909B0D74F2728FAE10
031A30D826914D130AAFFCC6BEC0E3D1BF8778997D2F5105689412B533D512DB
2EDC5FBEAA117B84CD73F94D1B57815878FA053DD5B8F22495F574972A787DF1
564969DFC28AAF2E0BBE58E3449CDFD4B4328CEA9DF2C43126F63B97B028197D
52FCD83D0AC7F9E2FEC733BA85A4CAA7350B10ADDFDF7A603A99E2DE27AB81CA
7E04332701178E39C77645B7869E17C1761178B23EAED48B81630C5B639DCC84
16319E849C9CC340680DF2FBCE16CA23E13E3836177CD7DC47A391F071C23E04
F5DD3EF119604C89E9BB00E3ACC03257597F3DE68A29BA6C7D207DD98F07D0F5
A6D740A051BE9508E0011600B1B788B305AAE9FAA6900B543F03A0EDE0696817
26FA058CD0D2444391927574818E2FC54D8841CA168999E3E958CB5DC19448E8
D15C3E5476B52EEBFDCCC47DFF160AFCA3605FC10DD8E3421EEFBE54FBC5ED5F
D890979E3F9153394D16F024BE1894A3122303D7C5886C3D883582A6D010C6E6
E2CAC4411C2D2665BFA253EC8E23F43BC162DC26AFC1EA6C42B305544FF51113
9B8F6DAD1F9130E4AC15989ED9B5F31EDC1CE45D4768976B88BC2AE3AC71F5BF
219FE37C1BA1D8C37E9FB4DDDB8A32180F9754B1E3E21AFF8B69BBE010EA784D
33620482EF9F56122F5EED58CF70B7D06FD663A6CF2DEFA20554E9E7E7177E54
A8B0626F21C675BAFA8D364154178BDFE8BFA0027911BC22D98C2FA0606C49D8
A821AAC60DC48831872602F64D31DD51E23C9BD6ECED28597E1DDDE0DDD2A3FE
FE5DEA57EBD609CF62D260F1061966B4DFD7BB29854E2DC75D2457483D24B260
B94113913B9E1BC1696DE3B6CB4CD4D5908BF1305538C360A13E74A9559C0877
8879CE47C6385889F1230DC163CD228A040D60346831FAEDC2CE9B87250F6BA2
C142E1E7974B4A44B0544E29D0D4DBE9B214C619297E0F50B56F22B8AB8F7EDE
4C0D04726C3B9C2B26665725BF241D8F694D8FC999784F51896E78E62AF4DD67
74B01384FAFDB28EE5FC5BACCF317E32D6D954E1949F492DA5EB32981DED5D80
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every GitHub Desktop version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories GitHub, Inc. and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to GitHub Desktop — just other entries, each with its own official URL and published hash.