64-bit
wixmachine scopegithub.com · known platform- File name
- Nextcloud-34.0.1-x64.msi
- SHA-256
- e81c052832383508c67136395b9304bfdd8bf7a4dbdd9b86a1bd4dd22272b485
by Nextcloud GmbH · GPL-2.0
The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer.
These URLs are the ones Nextcloud GmbH declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what Nextcloud GmbH published. Delete it.
Windows · PowerShell
Get-FileHash "Nextcloud-34.0.1-x64.msi" -Algorithm SHA256macOS · Linux
shasum -a 256 "Nextcloud-34.0.1-x64.msi"Expected output
e81c052832383508c67136395b9304bfdd8bf7a4dbdd9b86a1bd4dd22272b485
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
This installer is an MSI package, so it takes the standard Windows Installer switches. That is a property of MSI itself rather than something the publisher declared.
64-bit · machine scope · MSI convention
msiexec /i "Nextcloud-34.0.1-x64.msi" /qn /norestartRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on a recognised distribution platformThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 29.8 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 0 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | GPL-2.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
The installer comes from a recognised distribution platform rather than Nextcloud GmbH's own domain. That is normal for this kind of software and not a red flag by itself.
The installer on this page comes with the SHA-256 Nextcloud GmbH declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 95/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Nextcloud.NextcloudDesktop --exactUpgrade later
winget upgrade --id Nextcloud.NextcloudDesktopWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Nextcloud, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
6A04598FFC5E39EC519CDC7E3F17C87ED7556214E73FD3294755643BAC0DB349
88D47F551082E6284D5C0845261A8110E361B6D9CE3FE805AF6BEC711514A34E
74AAD01A110F3277F39A2E87ED18CB3126EE0BEAEE7B56205AD953DA83E614C3
A0B7FB3B31AC38D8FE04A4280B83C3A05664D0AF38B875D792A79B06F5B4A2F3
01F4A46048195F0EE8882FB93C443804B273634EC975AFCB400DF952979D5597
01B249B87D440AFABABAB42607927A281EE8C6871FB803659FD786A9E4360B69
BFCA6D0C8BE5A9EF083EBD6C85B92749484E2DFC580C70E8286CD0D41B5ED53F
93C23F43E3B180942FBB2B2BA3181BC1620470D2846FC3EA79681EC3EAFDB803
DB0DEBE38B9F893527F9E510AFA575261A3E1BE39F7D3F54FFA556F5DD8AF9DE
3934C805FFCBEA7792F09BA16889FD85888C2DEFB9B6322551721C0D6A45CE2D
9262F98C84E64D97B972146386CFD638DC5EEB54A5A620FEA967DFA5F6FF1C6D
ED8DD655238EF90F59F7E624449A135672B0B2E0E87AD78D95B742292254EEEC
6DF10E01F2D6EE49148D0F2793F40D8950E7FF3FE20A8A39198B2B81620BE46D
F26090134AB84F69E66828C193BFCE1B33B6177BE1A4D4018F3301A3619D15F9
66E2C5A322DA3CA999D750449006AA31431A9E432BE672F6F7E2CC55F308486E
8B46EA9F9055158DF3F21B5836F6E48DE75035F069431498730CB98D548F3E22
E68645A441B4BD730FBA693E44B4FB958324EB42C6B2930B02D2A6D3A8A73A6C
C3AFBFD7A08012244BA090259EB9E9EF2B37D640EB2175FBFF50E30BE9EBB14F
F3571E9321305385C6EA098E12D01F4C0465276771458BBECFE92FB271A0B3C2
307EA983DF09FB86DF5C4FBCBC17E38438BB4B2F2C73F473C3ED0AE14A691632
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Nextcloud version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Nextcloud GmbH and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Nextcloud — just other entries, each with its own official URL and published hash.