by Apple Inc. · Proprietary
iTunes offers the world’s best way to play — and add to — your collection of music, movies, TV shows, podcasts, audiobooks, and more.
These URLs are the ones Apple Inc. declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what Apple Inc. published. Delete it.
Windows · PowerShell
Get-FileHash "iTunes64Setup.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "iTunes64Setup.exe"Expected output
cea2a74cae3f061eadc11358eeaae9b40cfdea9ec1ee037b47da54a64219e182
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The unattended switch below is the one Apple Inc. declares in the installer manifest, not one we guessed by trying flags.
32-bit · machine scope · publisher-declared
.\iTunesSetup.exe /quiet /norestart64-bit · machine scope · publisher-declared
.\iTunes64Setup.exe /quiet /norestartRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
Silent install commands for every program we index · silent uninstall
Every guide on this tells you to hunt for the product code with Get-WmiObject or in the registry. You do not need to: it is published in the installer manifest, and it is printed below.
Product code · 32-bit
{C0E50EBD-FE23-42DE-84C0-D1B593278750}
Uninstall, with the usual prompts
msiexec /x {C0E50EBD-FE23-42DE-84C0-D1B593278750}Silent, for deployment
msiexec /x {C0E50EBD-FE23-42DE-84C0-D1B593278750} /qn /norestartProduct code · 64-bit
{F0D2C441-5D79-468A-AAA3-C9A3B629560D}
Uninstall, with the usual prompts
msiexec /x {F0D2C441-5D79-468A-AAA3-C9A3B629560D}Silent, for deployment
msiexec /x {F0D2C441-5D79-468A-AAA3-C9A3B629560D} /qn /norestartThe codes above belong to iTunes 12.13.10.3, the version in our index. If you have an older release installed, its code is different and this command will report that the product is not installed. In that case run Get-Package -Name "iTunes*" in PowerShell to read the code of what you actually have.
This removes the program as the publisher packaged it. Settings and files created after installation, typically under AppData, are deliberately left behind by the uninstaller and have to be deleted by hand if you want them gone.
Reinstalling and hitting error 1638? That is this same product code, and the command above is the fix.
Product codes for every program we index, with the msiexec switches and how to read the code off your own machine.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 2 of 2 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 2 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 2 of 2 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 6 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | ProprietaryA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions iTunes registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from apple.com, which is a domain we have tied to Apple Inc.
Every one of the 2 installers on this page comes with the SHA-256 Apple Inc declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Apple.iTunes --exactUpgrade later
winget upgrade --id Apple.iTunesWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of iTunes, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
EE6BEF6379042F1F94B25E0106CFFB9D305ED01C784E1E82E57C805723AF2AFB
8364987EED4D743F8072419AF466D05351349A723AF58B3ACC7C830A7EEE6210
D26129BD0716C157027ABF986B89E1D0F441DC2ABB752CFA3C634EBBC6160391
3C11EE5F937230BFB576705A143A5AF098D87EA087A1E0F9FAA3A892ADF24481
12D8EDF49FED3252E86CA94304EF44556C1FB8ADC5F1832E36BB9B932BD2F99D
2F5A7F4A85E24810297CB3EF63FD6D743DF1C62EDFC5E4CA3677C7B083BC2FF0
C762F0576141A1DBDCC5B60744C4405D738FBE62CDAE7BC98C6B0F6F60AC99B5
D0B744A580F812D982C0AE0AEA863373B900CD68F5E3A5F7E55C4C602F0AC7CC
CB89EAE87EA012C297C891CC0A3706FD8A0CFBE5FFEF462F257BF97E4BA62F55
A8A291080C11635AD9D9300DCCE6630D7FB8631FA936EEE5CE372987C1233542
A037A56E7535380DDA167FF8D47D76295031D4C44FA87747BA199EB47B3BC641
B3D7C02032AE6AE3649914F70803E21F791B5399E2FF201FBCEFAD1DC059C192
145A32239B2DA5048920F46367FDC672DAA91C66CBFBFF039678B0E878791D3F
9CBAEF01A8E2BE6F4AA68768484268DEF7CA71491B71E56B435D4878DA3232FD
6E2F30A48FEA70D04A302D19A33B4FDE3DBABE4EF9AC3205E2D91D8692298CAE
6FEC6605A0166E60F4D931DC308A444280C88BFDCC93C095DA320C43D5C6EADC
122EBD72DAC7D507EE68FF2EC20BA8322D95241DB80A677A36F239931474DD7A
BECD816DEB6E2A5D34F1CBFE16B9A160603E0A47D4D704D1DAA0662663000F8A
97584C3E1E3D7CEDEC144915DDF516ADFABF4E8219BCA60FD02961EBEEDBB46C
A0694F030490C7BF96403D30116478F9FF573662CA8FA020D6A4238D6934B768
D893492EBF63781293D6990116E940C8235A6CD201846622191A09ABE6F0D0B4
0739BB6C007A4A08DA8F3D5046FCBDE864546FD5B1F84C258BA532A9A1E5BDDA
290B1049948D08A813392D437161AE4D44F4A7898D13D92C5E98FF02A21D8F7B
7719C33C77D0DBCB1E424D48DFBC52A12D06856B0BEB6E4B22D16055BB5A3A7C
FE8C80C742DBDFA8CA9967CC9E6B0CB9EA20BA07EF3A4A13F57E8CF79E4A7B18
72D0CC83A571C1293C68C00E042068A76DA3DC96BC7DD1044AAE441F307868E0
3EADE4A71CF3678F413B9A4FF29853580EE9B97B121F7410ED136CBDFD56EFFC
30BD56C7B1467EBFEB7EF01458F5D14F83E9B0C1CB84B73A10EB4B98413E55A1
0F9BECA9148F5CED1AB77B4024D462C54846C4B3E8A4E1DCBEFF730B5E5C66C8
B8DC7922CFC2DC5704F1E64037DB0366465ED1A37E5C405587825F04EA629AE8
07C0C72F364F8C5FFDC4A4D60DDBA7081FA82971EABCFCB25D4E6B223690527A
132CEB1291D594C0FF26680018DB6EDD6EE67F2E541E51F1CF57103FD12219C4
FFF4A32A59B2D78EB2807800D30A05E0B14D1B16DFB70FF0EAE20B5A45079FA7
23A82361BFBBF4A2069839B8819E293D7A9FA25072333394887248A1F20ACC01
2A4BAE8CC0C0287D9D7A5359082760F00B5038D27A565B46BDA81518A0BDD5D7
3BA6A2C78A0FDC4BB211A5E8C0C39E186421085F4252E257B94FA13CB7ED3420
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every iTunes version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Apple Inc. and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to iTunes — just other entries, each with its own official URL and published hash.