32-bit
nullsoftmachine scopebuildbot.libretro.com · publisher-owned- File name
- RetroArch-Win32-setup.exe
- SHA-256
- 44ebe1f1e8fb058ba2f943b0a71ca128747c73439bd8c40b13cfd9c1fa64442f
by Libretro · GPL-3.0-only
RetroArch is a frontend for emulators, game engines and media players.
These URLs are the ones Libretro declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what Libretro published. Delete it.
Windows · PowerShell
Get-FileHash "RetroArch-Win64-setup.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "RetroArch-Win64-setup.exe"Expected output
bb2b95329542d98d951bb381c0dd57e803d846242878895f12d374b87201c1c9
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 2 of 2 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 2 on a domain owned by the publisherThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 2 of 2 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Licence declared | GPL-3.0-onlyA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Yes, in the sense we can actually verify: the installer downloads from libretro.com, which is a domain we have tied to Libretro.
Every one of the 2 installers on this page comes with the SHA-256 Libretro declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Libretro.RetroArch --exactUpgrade later
winget upgrade --id Libretro.RetroArchWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of RetroArch, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
0E4A256A93300FD7B0B220501155BD83EF70F0324296EDCB82C0CEACEE657D63
475134A2928E3A5C7567C537AABF2E96B43AC6AAA30D62C375C0A515EF003CDD
F6E25BAE5F3A19CFA91A1EF90E7DBD047F067CB162B4D7BBFE02DF4B0753265E
5792EAED9269E24926686B4B69B69954A68100A4782BFB4F947EE40E1860DC9D
1EB90B178CDCCD525B4C9B6528D35A8BF2CE6BAAE765CD531B83DDD0EAE82731
0AFB92E12BBA77C0F6C0A32A0B56CCF7ECDE2AA14A6ADC6D29807A3391AD3C62
0B542E1140A5A9E6F52094B9CE7F9615AF5459EC3F5B5B2376F2DEAC6365D426
C68A3909B3D0CA0BFAAE09DA0EC0D74B046B4FA65C8E11B96527757935ACF2AF
878911F7B1EFE9BBFD12588E004F2D2DC326A6CAA309BFA70D1E042FE169AA7D
B2CF87B4F537DD9823448ECA2DD9EC23F503A18D3154D1F8E73C619E83D1186B
A6709B61CC564CDC01E24D25C97696D9F92C7C7A2A6D15AC78201EB025E16306
336BEC5BF02A52751B775D892C13035A4448D7046A2E0C0AF482A58C4AB6042B
DEB0B6BB73B394A85A939FAD2E8C2BEC164B31FF935B1ED85E6A21B37A7563C1
D8ED0C5D1312CA9A323A3D90B821CD13F08A5ECA8A27D217BB9F4800EFE20ECE
B832E4713B650D38FC41F2B7DD72E0F63ABC4A2C53398F513C094B41F06C5865
31B3FF5EFF0340DD2FFFC4EE25CF68C66D10B8D0FA255E35ADBD9500F69761F9
BAFA6F7EB2530B544908FC67FB6F0ACD91F2BE1457925FB1398DB890554092EA
4BB28297FA1AEBF7A9C0D8024F5589F139F48993F75E1F5132B33C1EB193AC7F
B786D85F500B927BC29B3A8A36ED103C10AFA18ECCF9D1913B32986DFBFD26B6
DA58FE432B099D0788141952181F1D06960D8506B289FA4281DE7530BEA9314E
9B7EF0336C48B3C57A8D76CD59D9DD3DA3E52BFB6638310A263ACD17523606F1
3450D49C992F3DDFB0E327F8927CB36C3282AF772F68F0B98D37FFA7B2812E36
ADE4C3A984955E418815BF55DBC63CF903AA91FBAE7F73070F84C403DD9E448F
699449EE871C4EC8662103BEA0D936CE2BCD7B5626A245B9A218A455D8609743
6FD7A2CCF3C09A4CCAD82AD84E7F6C2753A5EC19A06E3EAB20D7E14B427AAD53
702C1E641B00F55865227FDA986B96D86E1C96169C5561FE522DE17525ED6917
563CA2FE3C9352B5DBE061AE5876815BBA8CD5A098BC217CEC1EE4E2E9EB94BF
8F855E0AEA8702A6192812EF29FD6EFBBC10A5B86833C943A404B8D422F3A712
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every RetroArch version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Libretro and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to RetroArch — just other entries, each with its own official URL and published hash.