64-bit
nullsoftmachine scopedownload.kde.org · publisher domain- File name
- krita-x64-5.3.3-setup.exe
- SHA-256
- cf6dc324c1f3bdb5d3069a7f7d7456fcbb6176fab1f09683a52b836fa0d97a05
by Krita Foundation · GPL-3.0
Krita is a professional FREE and open source painting program. It is made by artists that want to see affordable art tools for everyone.
These URLs are the ones Krita Foundation declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what Krita Foundation published. Delete it.
Windows · PowerShell
Get-FileHash "krita-x64-5.3.3-setup.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "krita-x64-5.3.3-setup.exe"Expected output
cf6dc324c1f3bdb5d3069a7f7d7456fcbb6176fab1f09683a52b836fa0d97a05
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 1 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | GPL-3.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions Krita registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from kde.org, which is a domain we have tied to Krita Foundation.
The installer on this page comes with the SHA-256 Krita Foundation declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id KDE.Krita --exactUpgrade later
winget upgrade --id KDE.KritaWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Krita, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
B68C3C1000A0660C79CCB82F7A85E9EDE0B9DDE055561CEACD0FF2A147040FB8
7542DDCFE4F75D9AD81337F053E81A4F3740B1D40E4E388A2BA489CFA29113F2
EA9236B685EC2F2E6A6D07EA388ACF28FD61BAF42520B35265BC7C87F8971D24
A68293C352CE8A196AB9574EECEBD61032A6FAC8181EDE4D5B7BE373991C2156
95F7ECB8B5B5E9F85927548CF20FF993B812352B7BA2CBA655D480D17E0E0168
0805DD6030263985F4F5FF572EBFB4891502E5E902243076B7F7E96041C18227
975F1BF64DA7BD5D69AEFE011D2C0C174D5FD5D1782B4D088A21B003BE4AA023
092297C5E6391E4528CC611F3B91FB4ABCB73B91E978251A97825EACA4FFEB5F
5E779C479292FACB3B998BDA06C574702DAAFFB3C54E9D7B178309FC16B82836
8E3395EAB5172E6A046548A62C25D1DCBF90C9BBE529EE11C91E69DA07CBE347
E394029B3529A7C7411FC200E5627368AC3818A4FDA4F453D18C86E220DB7057
F419F4F71A99E59C4C65573388F2F5440E65341C47805240659578973A7516D8
86F20A01052C7E9B468DA751EC19D091FDA2FC2601890204BE0698A70797CC2F
D67C561674D8A72341ED815FF4FD5F8AD58108950B2B3AE31807C25E25591B47
F4FE0A3EDF163D7154A6F6B7E9634494BE84A666A465DD59751E27659DFE3C50
4165E096D2B776C80B113372F5BC85130312FDADA2BB7ABD6FB05D3E43DEA472
2E943DDF8943985AB7AA4AF55BA341B588B6942BFFB871214805DFCB738883EA
6CA0CDF7337F3C4AEAB284041695B5821ECE1826C9C163DC44A01D593F8343C8
093026CF35D9C1B9E8CC70FF3C4B3424215486EE3B75EB01C58DA4DBAB5669E4
758966AC9C4E0A583473EB7851BEF945BFA0CACEC39BF0474485117E02A0AF9F
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Krita version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Krita Foundation and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Krita — just other entries, each with its own official URL and published hash.