64-bit
exeuser scopedl.pstmn.io · publisher-owned- File name
- windows_64
- SHA-256
- 00ae18ffc1b565a3a3bff0cdb54e42fe6f5dc2896feaf02893e075b9b0d8af2d
- Silent install
- --silent
by Postman · Proprietary
The Collaboration Platform for API Development
These URLs are the ones Postman declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what Postman published. Delete it.
Windows · PowerShell
Get-FileHash "windows_64" -Algorithm SHA256macOS · Linux
shasum -a 256 "windows_64"Expected output
00ae18ffc1b565a3a3bff0cdb54e42fe6f5dc2896feaf02893e075b9b0d8af2d
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The unattended switch below is the one Postman declares in the installer manifest, not one we guessed by trying flags.
64-bit · user scope · publisher-declared
.\windows_64 --silentRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on a domain owned by the publisherThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 0 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | ProprietaryA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Yes, in the sense we can actually verify: the installer downloads from pstmn.io, which is a domain we have tied to Postman.
The installer on this page comes with the SHA-256 Postman declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Postman.Postman --exactUpgrade later
winget upgrade --id Postman.PostmanWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Postman, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
4315F9100E551DF8BBD17430369F4CD731B59D41440D888BF7440DA06F41D498
6EE3A5AE25A164F32E88F8CF7593D205C78956C7EB094C334E69313132AB7C3E
A119BC894BE2ACDA1E2888EF428734932D0A84B0D993EDCB9006200676627F03
A1179DEBE78E20585B581589090A77D99B6B8F5AC85A3B02FE8539AEA768A5D9
CB51813E0AD74967780569ECADD90D7CFFE73126D1E13DA3A7E9265A003B53A9
C3B93A45D2378135135EC9BEA99657F39C405B6B218D16A92A94228BF45AC032
376FB319813968B00DE6E482BA31A689CDE4D7946084578FB681EB7D679E472B
AB00CA97E0D4E833CAE6C301C9A12FD5D6555E249996530523A5DD0C5C8ABE18
79289062C16BCB628408510784C52A4061DD873719BB4AA7BB7068968F956E5F
1C562861D9D24A3EF53FD0A91B505C44F02F4F487E0D0E83AAF011F7A117C38B
E22893F590746AE50280C6BA8F39AAA0E611079083791C93CEEA636CC60BA073
8D2524D4CF073ADDEF35583103357907A29ED45B8BBA0AFD3A4927A61D8BC4A9
14348111DD748C5C1981D0A3965C6ED1D375D51791D89E83C1F7E1121342F023
F1BDC5A65F59D5DD972C611B2EB2B217CA97EA8F2199FC59AED4D31E346A12DD
DFB73305F085A56686B04ADF91726C34F12B195C816C650A491BBEA3C8E2559F
066705A484F6BD4EB514C2B2339CA0AFD0FAE17A19916784780C820368F29069
44FB36C155388CC4DA30B6E8178C15EF8B827DE89CABE5FFA93F6414C4C1A523
A5C9629035213D2D16C452FF84E2412AE06ACE6F288FEA9543041CE8487AA26D
7B4409FE7BE5B57E59E60A32A9C0961E4419B98EDA08AE7F05188A3B791CFD83
73A7F7629230CD92C5671D9C5539F33E03183774A36AC61B575FD29892F663B2
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Postman version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Postman and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Postman — just other entries, each with its own official URL and published hash.