32-bit
portablegithub.com · publisher domain- File name
- rufus-4.15_x86.exe
- SHA-256
- 20e1345715aff4aebf016839f721390882201a2b5d00655424c4ca38cb919576
by pbatard · GPL-3.0-or-later
A utility that helps format and create bootable USB flash drives, such as USB keys/pendrives, memory sticks, etc.
These URLs are the ones pbatard declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what pbatard published. Delete it.
Windows · PowerShell
Get-FileHash "rufus-4.15.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "rufus-4.15.exe"Expected output
84c8a437f8af89257524478489e5c85f1edf25f761d299e2bcde46ac0afbe106
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 3 of 3 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 3 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 3 of 3 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 2 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | GPL-3.0-or-laterA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Yes, in the sense we can actually verify: the installer downloads from github.com, which is a domain we have tied to pbatard.
Every one of the 3 installers on this page comes with the SHA-256 pbatard declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Rufus.Rufus --exactUpgrade later
winget upgrade --id Rufus.RufusWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Rufus, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
C4C2030901C9069228F90EA37A33D2B38EC83C2CABA8BB88A4C3B8E27BB4FB78
9FCAD316C82BA3D0C3130C9F43FB0FE147E9EB62E1BF830716A0BBB6C58D24EE
65461A08DD88F0F2D7BB08FE0E8FEAE33EBC75BC68F25F8DD7803B8F42BC5267
41FDAEC35B173FBD00E24AF18A763A0DD19135D3571E145661844B31CD576721
A314DB019D608E3D9B2EDA797BA5BBE4DFC91BCD621DECD144A580080EB13B1B
E4853C8F540631EFE9FFE4E09A1ED6AD7C42EDA37C6CC444020EEF8830645320
EA003A94ECD3B96117F57657B899BBE03C29740D5EA0F2C636CD651B292BC32D
C19E9AEA0E944DCD36BCDE3D5BEBB60772DE4AFD844C6AE7CB7F5C5AD5742AE0
039690F1408EEEDCCCD60CD5C42B648A2DD691990F5A1D91528D34EC27D19180
DA70B5A684B643798EB20B720BF362E01AB6987EC47BD99A12F6E2D950A446BF
ABBF04D50A44A9612C027FC8072F6DA67F5BCDA2B826F1F852C9C24D7A1FCDFF
D826E054400C2801FF36BAA2A46684EE5E133B5267E4B6A97B02BAB337152018
E35D98FF73FBF7D09AB6CAC73F65C7EF959C2B5810A53CC803ACCA4A7F8A7023
286912931E906857911EA7EFFF981BF804A42E569B49F94B9D52AD354E577775
92B2F9D1AD82E6D48C8C74F118C0A13AFDC1080BB0F9326F5C3F38214F2DA384
8118ED5D380E4C45367521FDAF7C4EF73F80E43B3F057D464587D1A05C6C5F7E
497F796E6D076D4855D697965C04626E6D3624658FCE3ECA82AB14F7414EEDE2
AA2440122F448EEC694C681676358E26E1A1605E712CAA0C52815D5D26989AA2
24DA1FECA004F8D6908A24AD76DE7E2D51904D1D079E8FA8A449F91A5E881409
092B1C10C0240E4AE16F30989C3F06A8E784067A944E4AA3E8A11A75F803D71B
01420EE7AB4438A93379BE61F4652740AF6A6A28AD57B5C0DA40038D4039445F
38215A377D73441BE536453697045F1A8D1F533C405FD69E90B4FF1B0650247D
45777D818FC9BA187BCC7B930583764130EA71100FD9E3C66D4A7143BDBCE4C5
589AF8786A40793C7F5FB0C9C25173288B567D8593D8EB18344AC255B26BAE29
1C3EDD36BDB686DE09E3A0AD6507D52B9F91FA3AE2A24658FB0F7C157C2C8DCF
8279696C1D78B14618500E9135886A3667B9DECC65946F3729002E4BFDBB20AB
72EEE5AAA819B442AEE34AEA7B075B0FB478A8DA189A57EE2936520707D41A2F
318F89696B36BE6667B1D70EAF211851B8289020BD61CDAA57EBC3A1500436E1
C6E6CDBA209F899E5087F1A1A4BABC759414B4A687B60BA4BCE62B6B37E8E82B
3DD2C19F81CF78D0D31ADD3C099F0BB99558B6C9E16C5B459065BCD2828E717F
42CDB16F6DD64C4FEC30C7A71960FE4D0015862C37E7B02C8DBA5C0D68384C74
79FE5CC04AF761BF15AB4AE56487C2CFD29444E25E001A88772FE60E37D80CAB
D58C8AE1A54A68486918D595D02C533EB3BAF0DAA19B4F3CBF6283B95B89C0AF
9507FDDB33ADB3E8A1832B0083847DF70E423AB8E63C15EB9E66AE507EF33AD9
9158FED9FB694BC7F7C0520205C101DEFDFFE225A4C1F9AF1A3C62314D51FDCA
B43002C98835E8D3D2B1A3A839844581C9A35274D6BC62AA082331285E1D7002
51F7095CDDBE64DA4C60EFA4306D3C469F8651CA2E9FB08E7AF10A7676DDCA5D
C8420CF0F9F5E9A413865A34D998C6E56617CECE45B2FB9F92DC28615BCC0ED7
4085CDB0770CE474923ACCA28B6061A7FA55AD217985BCE3B59301537D22A0A9
1E95FBF8DCC2F7D4EA564EEEE9863CF30CE99150EC79CB248B951A48A1A4E577
8F680FDC6E91AFF40066ECEBDCFBE985A058313E6DDC024A9123FE0985493035
D4395B56ADFBE8E0362DB463534E4B11FE8388297B58D0EC9FD9783A544DED93
553B7224E672B1F234BF4D73C40FBD13834DA4D2150FA3239E793302C8433BC2
393B677FB2F281514B739E8C05FC326829AF0AFEC5FE5F3B91B55FC3B6237C65
BFECF4DCF1A63D8B64B900906102EDF666642316291C9BBA42EB0FB9C7BCCBD6
D41D72C239C4561D86A4D4C0D76A0DCA41BD8798BCFEFB7BFCB7EFD073A6F391
1E9ADAE0F5160966A13AB7D1D48B88AAC64D4A04082378ED18A06AD6175A4627
0496D29183FE30F00AB452249AE4AFB358628258AB63BD9E85C077D162DBC6D7
AC2A1743BBFC19268C36280B50A003366D41854863D4808099CD87F77FA5F433
6DBC625B182F6A9307247F123D03AAA28E9CF8F169A678CC34C39707B0E2079F
3B07D65B2AB8A482708E787BA44A1A8D0283D84EAF37280A5D865AFA0973C0F6
D0554F1FC47407D678A4D8EACE607272013C475033B636BFB1824ED6B1A22E36
DF9D4A8BED7AABB343914F69817A4EDD9A53F1BA6427257ABB771C1BB39A8026
9BFCA68B1451151835C1908B3EFF778F8EC24C5B390C63A5A5DEA7BFA0EC9A91
042F0B284AF6E3316BAF6235A4F0141966A051873B5631C7E5A724CF1F5E7973
990A903E697D30EEF5787FEECA7A62E6AC3A92294AA1BF9340C1396D630B59C9
1271F3FC66AE7516D06AFB1D72484CBFD13C168AB4CD19C4E60FFA72A95424F6
75827940E5D821F30951E641772696BAB6D97E37E3479F70E1CA4B8CB4D40132
163E93B8116CA76045D0FC34DAF735CB72FDFBDF7938BA293EE39187E9674135
273329940F34DADAF7526EEE89AFB6B3E3F728855320C20C0F4F7296BE4450AF
728BA1C9326527347E7F5A648648CB88BA8EE04FB90FBBD5D23A378501AB0FD1
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Rufus version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories pbatard and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Rufus — just other entries, each with its own official URL and published hash.