64-bit
nullsoftuser scopedownload.kde.org · publisher domain- File name
- kdenlive-26.04.3.exe
- SHA-256
- f5dcd8ddb7a8ef6754cee7515513d6c777bc68079c6fec37e20373f628f65fe1
by KDE e.V. · GPL-3.0
Free and Open Source Video Editor
These URLs are the ones KDE e.V. declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what KDE e.V. published. Delete it.
Windows · PowerShell
Get-FileHash "kdenlive-26.04.3.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "kdenlive-26.04.3.exe"Expected output
f5dcd8ddb7a8ef6754cee7515513d6c777bc68079c6fec37e20373f628f65fe1
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Licence declared | GPL-3.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions Kdenlive registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from kde.org, which is a domain we have tied to KDE e.V.
The installer on this page comes with the SHA-256 KDE e.V declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id KDE.Kdenlive --exactUpgrade later
winget upgrade --id KDE.KdenliveWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Kdenlive, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
A9FC060AA7D026126DC68BB24D0F5ADB4F610A3D91BF6775DAAF25FD1BD63145
6EB87F934CE9B37D5C0D8D584227DC970D5B31279A77D95A07ADD6BD39AD7902
2DE6FD3E7F0A606DAF55BE7B1FBD08D8D066C5AC20BE03C183100F1AC997BA2B
F0ECAB2FFCA1B812DE51C0C9556ED4480E1C9D611E32D67B79106965819A42C4
A9A3C693EDF66F730EFF3332B95FAF0D88DAF610027678CDDF5720402D58E373
63CE996ABFD04E13AE9A0A08AE0A0B402CBFC8B03626D5D92FF5661B958E7023
2617F8025B3ADD844B62D9534C58AC1851142ED07B4EB88BE8CF56587DD2DDE7
CF6479268107396B1A9BA1F73CD96E676C208620525861ACD32089FE64AEA04F
9D67EDAB7BE66F4E016580139F183131B2F62A712C3D48954BFE3DAE89DE8D6B
4ADCDB19FBD650A95592E5B4A5EADA11F84BAECEC8AA5E60D813D6275D37526B
533898498FB16502B7B16EFCDA8D636CB9E556E00DEB2C1FD043D9B0C132E46E
BE4BCA1B8AABC31F454AD520D8E94AF6D9E8AE9D837F96B3C85DEA84FEFE2B20
5E7356F0C422C08DBC6930B93A51E9A24D17551E2313F32884233BB9706E231B
B302A867E461882BF73C1F9197B30E9A481EFA86A8CCBBD9DB9D774DCDB9853A
46093697018E770BEED154DE314D67DA9AAA23E0F73F6BDFB12F2C57E137E498
897869933906D90D7E844DBC62676823C0CD393EEB92BADF64C6343FF2BA7731
5ADD33F6AC8C05F56C2AF9559B38A189568741D262CCB8A90F16C0B66DC3F021
EB6BEF8491CFA2F214AF18D6E5DC2C1D14CE0043A41FA19B0EB64375DD1EFEE1
7BDD286828837118804E97D2A9D9CF1BB66DC1F21CB8A89378081EE543DDD327
EF6CE7BAC088FA28DE1BA845AFAF71BB360053BCEB48E2CD3476E260859F99F4
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Kdenlive version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories KDE e.V. and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Kdenlive — just other entries, each with its own official URL and published hash.