by Microsoft Corporation · MIT
Microsoft PowerToys is a set of utilities for power users to tune and streamline their Windows experience for greater productivity.
These URLs are the ones Microsoft Corporation declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what Microsoft Corporation published. Delete it.
Windows · PowerShell
Get-FileHash "PowerToysUserSetup-0.100.2-x64.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "PowerToysUserSetup-0.100.2-x64.exe"Expected output
945fdf327e4d38e4ced61b0727b7ab8a1222958782982052989ddf7cb7096f62
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The unattended switch below is the one Microsoft Corporation declares in the installer manifest, not one we guessed by trying flags.
64-bit · user scope · publisher-declared
.\PowerToysUserSetup-0.100.2-x64.exe /quiet /norestart64-bit · machine scope · publisher-declared
.\PowerToysSetup-0.100.2-x64.exe /quiet /norestartARM64 · user scope · publisher-declared
.\PowerToysUserSetup-0.100.2-arm64.exe /quiet /norestartARM64 · machine scope · publisher-declared
.\PowerToysSetup-0.100.2-arm64.exe /quiet /norestartRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 4 of 4 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 4 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 4 of 4 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 2 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | MITA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Yes, in the sense we can actually verify: the installer downloads from github.com, which is a domain we have tied to Microsoft Corporation.
Every one of the 4 installers on this page comes with the SHA-256 Microsoft Corporation declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Microsoft.PowerToys --exactUpgrade later
winget upgrade --id Microsoft.PowerToysWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of PowerToys, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
AA6D47950061A856F2A6C5FB12B331658FED930A05A739DDB4FEB95BFAC06187
4ADEC909794AE1489CA5D48BC318E9BE6DA6F9817195AE1B8ADBB52B99C4D179
0BE062A7B74F18B54C34F78F0DA4FD5BAEBAE896A484A1B0DD41D882848967CD
4E537C7C7FA31DE6D5FA4DA6DC7479CF33E52EC28F0E2C574032BAE987A4F49B
A5EB64B8CEEF096AAFBFC18E73312B45E9D48FC60FB16676429688468C9A08D6
740C01945528E453C02490921CA2BD0E399021A80CF90DCF01DB53158377D0E8
A4D7EB580A7EF36E7C98CCC84E9EBB552C9D7071DCA35B6EB395F938D03FADCF
19C8BD93B9A42B7FC2FF0E6F2091590F8D89B98ADEA20CC73D9023E464707B12
CAD34AA632251CFB9BDA1D6FE70E0BD5C150AC6FEC7AFB0BA179DF90413430CD
29210F756B93DC1871694FC2A6BE89AB0BC76227F66FFBA0F5A80F408E576CDD
7BD4C3E66D64339C40DD42EC58DE8F25E2B81ECD90C45F0AD95247024F508705
64B2B06FE83F2F287EAFED4DE445C88CFCA6C9CAE14C718FD31E4D57EAEFB3DF
FC417BF42D6497A87682286FB541D4FA789EF0E4A812571BC0C2E4D591E63CAA
43B25C7927D43B9B8AE0B4B7116A7A4FFCA66FAE031BCF4B30FE38AC382C6F35
DD9F1E0243A16ADAA831F8E1119AE7394CB031B5B12401A0A243880F8F099545
E52788F0B199433A56B0CEA5DDA3611DA2F9D0AF123E2E90F9A908D8164AAD20
0DBC8D647D17751D2A6B9E6976F4E48055BC054D2601E3724813260243430D4B
5FB80097F73F3A9EB668F4C8AC7C4373E85DD0A32817698EE9D411D81C89BEFC
6FF46F1AE83BFD9632B54FA5247D18CE70E3051C2CFF0EE55D45979CF84B243A
FF30180A78ECAE2BA42665333D4076364A0EB7A4643052A22E1A8DDD154217EB
54A39F62334F7481C1BDDE8ABF4928F2E74F100A049F50C7339DABFD34134C98
D0316CCE8A586CE060390830FD0E3ECC298498159EEAFF2472A1BF3D2616A5E4
BB24AEE4B0B8EBDC007D04A84843D44008AB585192CF145816F4C07C99251BE0
0CC6651BF7A3CA7CF63BAC0886FD7B314A5C4648D8C7212F22B4D5729CBD54D9
DB4AE01B6A8A9FC056A8A5FA579AA276D5E713455532AF33D11895FA381FAA0D
9D1E3337B79FD6C30463EB6EE5D58D1DE63018BC99516B982EF4423A75FC9686
B16A1AEE649C82DA4062B7BD2ADBE68A9928CD5FF567BFA9098C0D70EE3653A5
C5445FE4D5B157EE9605B58036E75C9B63064B2EA0132D0C4719EC7C63F65D66
B8EC0033F9BA6A6D628F2F826E1B00D6B9F9A6869D46D108C5B08B560A46890F
267A7CC18CA33CDE4F79BBCEBF2FEFEC29B6A540BE96218CBCB52064DA283673
AED4001D4C3E974FAF5D2D46D640547A25BE718D8C5FEB20F4C9A1C1976D837D
16C211C3441C1BF22C491457BC6F0F8C6FA796E9DE08EB67C993997CDCDA5FA4
86EC5D7639ED3624ECD53193C0B0411174D17E72F8C7507E8206A52F78FA4A24
E67D2D4098CA0CEB6910D418989567F4A62CD868210E1B29D8A76E0E64A3626E
8B1FEDE0F9E0BA9C24270DBF1D40F967168C83B3F10B26AFC778286D560DFFE6
0F5562A1C2AD8BD42D19B79EAD72BB7AD77C3EE2B93C2415AC15015CCDFB6F8E
B4BFD22E7A467AB07BE8388648C8B084B67669FF6F3DB80B2B9B56AD95EB7A12
2DBA44E6CAFFC95713766C6B157A2E92BB3C430CF9B0BC798397E8AB3FB984A8
4822F905879C786AEF5CA325F1E8A0BA81BD863BDB5A610795816D8CA571E852
AC2D7841EE27CB237D0F00270719F80887C77F177BC931A90563F6AA897739E2
F2B57F03575591591192DC486162F5FA113079F515A48E9ED6B3E2ABE0FE81E3
967B0E6C47752702472A6C731CD4BB053D9216159A2B6BECAA76466F3CD987D8
FCC6A34EDC76366BFC01723A1B3B4A68233727F5501308198130FEAB84CDC533
57093A0A3F1E678715B0B712E791AA2EF70DD2A9FC9448C3ECC5F8904B31F766
CE6654859BBAEC0E2AA49FF2E4F5C1353C4204C85A2CFB15E1E5CEC51BF3B003
A0C2A2E2EB8C86DCC6E42FE652490F41B61D9C4875F170A63EECA353E7CEBB8B
1AD77D7D60D3D353C9F6A391759B4596F43F4F21549625BB8B22EF21CF7E1B55
2E59B5EBB86C9B7EECC57F902F709A67103AA7AA72396FEDEDC40BB6AA67AF20
F395CC209B1F77191F96DE3CBF2512B66C8BB4C562043BD1A3A7FD4B9C7B5BC0
55D5B07AEC402D504AED8101BF4F3FBA79310198F004A4D74326F951FA7BC7A0
EA2E430476BD54E359A401623863E5130A500A169EF9FB27BBB064ADB3887AC5
E111A3ED83D1FB33386A5412AC5324C15E684D89512BA988ABF12D6E95691DB5
DE0255AC0CA3B77957EB8B36F916C38A8C4CEBDACF245774BE4A771E5EBCEE3B
87AD002128903949EF4B2E377865C3880CF2435E196DEA5520698AF9860D6201
B7A90D2A9A5D197C3AA223DDFAD9D9708A9E19EB108893199D3BB5E1E7893B9E
F5FD52489576E41C378A5A6BAD441BE9DF1881D466BDC6C1D0BD7385880AA1A3
279886E446D96C3816D5D478D0A31F0458E336AFC0FD6D230064F2A72FF14421
B5B263C259A5EB40D76E564DBDD095BF878593924E61761E8EB70B8351622E62
E7495316BE3CCBB5A684B6806FDFEB8BD5C114B2EA229346DA442ED43050D8F3
6262D2491AD4D7E2429E402F29CB6B1A8FA7412714EF2BEFA2B9B692B3AEF502
E2126F7C3BAEBEF8367D4702489654B13E211B5CCFA1E3AC437CAFC772B1A219
3419E846FB242D2B7DA8A4259E06DB8867770806159C665FA966E85669D258CA
5DC32A790F2B6D9C06CA3397E9ADCD382472BB2C9B45BC288D75DCB951A20FAF
367DECED2EB112B0A2F4F4828D198EAFFB1E6CEA8F7716BF533145D572ABFD13
42EA4A3E8C79A5456476D19E72B3E2AB9393A89C4DC7442EB7EE5A1E3490D38A
EC4BC3A8625775866B0ED4577CCF83E6EC7B1A0AD267379DDBAF4FE49C7B5BDD
F3F433FE04049F9197411D792AADEBF34E3BE7FE16327BD8B73D2A046ED8BAF6
9CB8911008420D0E446AE3D5CE365E447FA4DF9DCF9337F3A80F933C00FC3689
190DD702EDE2D3AC27A253DF8BC2416B1AF05E6594FF25CABEE844E6D3C8CCB0
2308D896D9A66C56B98AC8B3CE9B7C945C7A2315551E36C118C7ECAC4A6D05C2
BE6C964C40147B5F7838E51A13837347756CC45E6AC5BC0DD11AF9AF605ABDCD
28BD1FEFA22C52279C6B600E677B425B014D1F9190EA449D6C63FC2702092DA3
CDAF760E86D350F9FCDE7ABD0950F1C0D5E6BDC2401169E12D8FD5F82A2285D5
0DF50C8896C73F0CC7C4E291E55350B87142824588DA6EF6334A9065392F44F5
E26B1F27C04358A112B5D10D4ED98ABB51399DCB5C1DD2A9017D2007E9AE33AF
9356847E88A7DD43DFE428E6AA8E35B196CE7B24CC30D1C3D6771167FFC8C1E7
B4F130CC96F321024A257499247F6FF6DA56612215ED3882E868AAE26C689E33
E18AC8F9023E341CF7DAD35367FB9DDDB6565D83D8155DBCDDB40AE8A24AE731
F69B00F4E520EB09FA0D1D1669E21910C5225FE7A2EEDC0FA7C283B201A5F9C6
17DEADEC601D6061D7AF4F487595CC36D9191813003CC2ECE381017F0EC71FBB
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every PowerToys version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Not related to PowerToys — just other entries, each with its own official URL and published hash.