by GOG.com · Proprietary
All your games and friends in one place.
These URLs are the ones GOG.com declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what GOG.com published. Delete it.
Windows · PowerShell
Get-FileHash "download" -Algorithm SHA256macOS · Linux
shasum -a 256 "download"Expected output
e654a8fdd66582328576d063a4f8ac5384e340acffe1f777d90407309af7d293
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 0 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | ProprietaryA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Yes, in the sense we can actually verify: the installer downloads from gog.com, which is a domain we have tied to GOG.com.
The installer on this page comes with the SHA-256 GOG.com declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id GOG.Galaxy --exactUpgrade later
winget upgrade --id GOG.GalaxyWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of GOG GALAXY, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
D7598EC128DB51D74E9E961B8348FD443E4B7060E45B5A2AD311E39DCADAEA70
C2888E0A1425823E47ED04C26E2D3C81CB14564A8E92D9C9628C3ED77A9D87BC
D04645EF5E4ADA875F48D74828EDD62222B2787EFF09CB6E1C48E591949FD8F6
77286D4356D04538C3052B5387AFC5116F96CBB793E694211044EE366F1DCE54
CBCD7CC9A2ABBAAA187CDFE6265B37ADAFD9737C3ED91B7EFB8BCDE47F033EA7
377C739F867F11923EC50E6A62B79C500D3A44220A813A440BF3404C6DE5ECAE
2BFD91F73B3609E2620E5614110EB97016FA0A9687AA463BBDB0DCF42D4DAF7B
198450252881AFF1EF8AB1F0BE651A41CF5DA843BC472296A66BDB9FFD84EF2C
90084B4872449F53A004B2FB177FB02F2F76852E006B35DD44B6D172AACCFA44
4FC6C6DCF84CDA4D72D0C22821FD73BD5FC96167AED84D1C616058F0BD38B8D4
8134CE8CF68E33A55D74EE8EE827D2FBAD7FA60209509918BB63415F05EBDD39
FA7A41F4DC62587739516774CD08139E5DC53A61C99136855358A0F88A5A9AEF
D48949B30C42AC447989281266BD542710949B9E291C9CC88456B9C2BE57F530
5602F89A33B1E09AA911C0D795DB695F7641501B1A74B8C4740C539AA942DBB8
04B6DE20A454F82B468104097B729119FD0E5D085FFB953CBE640539B6D66755
28042C8C4E879BE96CDDA7C428928AA242E98569EE676B22C4DAD377567FCD37
C28EE546F745AB005AE535A8B40AB21A24974560A46FB81367BF905AF0D07E19
C84C0E6673729F8B31A11EF44BF380E0DAB61F2627D222A5944E922E717DC36D
891D0293F4E6DF32EB813980DCE4D1D6923C54D1BFAD763E2C34254786D9F3D4
56CCCB15BF930B4EFA09791D72891E2E87A403386DAABF65A579DB3C2FE8FEC5
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every GOG GALAXY version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories GOG.com and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to GOG GALAXY — just other entries, each with its own official URL and published hash.