64-bit
exeuser scopegithub.com · known platform- File name
- MailspringSetup.exe
- SHA-256
- 0b4e511fe881f8202cc75f0c461c7bdc666f8d87b25dae6137740384e2e00f76
- Silent install
- --silent
by Foundry 376, LLC · GPL-3.0
Boost your productivity and send better email with Mailspring, the best mail client for Mac, Linux, and Windows.
These URLs are the ones Foundry 376, LLC declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what Foundry 376, LLC published. Delete it.
Windows · PowerShell
Get-FileHash "MailspringSetup.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "MailspringSetup.exe"Expected output
0b4e511fe881f8202cc75f0c461c7bdc666f8d87b25dae6137740384e2e00f76
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The unattended switch below is the one Foundry 376, LLC declares in the installer manifest, not one we guessed by trying flags.
64-bit · user scope · publisher-declared
.\MailspringSetup.exe --silentRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on a recognised distribution platformThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 29.8 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 1 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | GPL-3.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
The installer comes from a recognised distribution platform rather than Foundry 376, LLC's own domain. That is normal for this kind of software and not a red flag by itself.
The installer on this page comes with the SHA-256 Foundry 376, LLC declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 95/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Foundry376.Mailspring --exactUpgrade later
winget upgrade --id Foundry376.MailspringWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Mailspring, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
30637325AC0E266E1D0C8F27287D7B99247D9ECD7C542DA6FFE262E0E8FAD655
22C359509C07E015B11C71CEF0E997DEFF6FD728CE4E97A216EA4C8F659AB957
DC17548BD5FC5AA0A3EA7C4EA723E58CE69FBA9CD050ED104BAAF8E822C0A4C6
06984CC4987F424C9EEC71C10642308E54FE91DB2EC3F4B25E8BCD44011C65A0
39D1E2E990BF86EA51DEDF5E5EE649A8DF1A60993418ADF4EB79E5F7DF2E0BD0
1EA52AAF446683EF041DB68056BF8ECFAD3E115117404651AFC0726FEDFA7AA0
AE0958E5DE7D4C0CB9E2B09C7F5F032A2F092F99B9BAB516D26120FB76E55FB2
B68062857F3CCE684CD4D35D1C0596C17C0A302891CC8F317BA1C3FB403FBB33
B0A8D89867549719A5EFE0E720804AC00ACD130B75377831DF7E8544DA8FC679
75B5249AC7B927A5B9F16227081A4CC45C23BDB6020074D5926ABBA70DE86885
78133A0A1D6D7D30EB757C3A01B03B7888F6FA2F8E40BA0EE5F194CA320C1A98
7AFB1C52A41D5DBBF3A0EA2BD25F1EB3701F95484FBDE1589E0B6832BADB60F5
A446C311C415E17EEACD48B6307A91BEED6B24FF1D8393FB34D1A238C87CE5A7
B78BEFE43AA27914CBB86D0DB430E8D639B6D469CD91907EE9D388E656F933B4
CEFACF528CA7FA9771AF134DA9C9A4D1CC429D2B5A78029F82EEDB91925390E3
CCC832CC10A1BEB2E9363A4CF042C32199628E7ADE37E9978A02770E081AD620
2E41EC42BDEED8D57449806B7AD2DFA74DE1B867B78E31B0391B95D894391FE5
BD603167522834BF6735721655964ED1A322B883F1629BCA7A44DD544FE5E34A
4A52ED2D32E0E8BE13CC4FDDB3C9A40351951DF1BC5160339E98909527D760D1
77F66905362599ACAC8BEF21178D20453C8615BA1B57D2AECAE63F05F7FBD718
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Mailspring version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Foundry 376, LLC and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Mailspring — just other entries, each with its own official URL and published hash.