by http://xanasoft.com/ · GPL-3.0
Sandboxie is a sandbox-based isolation software for 32- and 64-bit Windows NT-based operating systems.
These URLs are the ones http://xanasoft.com/ declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what http://xanasoft.com/ published. Delete it.
Windows · PowerShell
Get-FileHash "Sandboxie-Plus-x64-v1.18.1.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "Sandboxie-Plus-x64-v1.18.1.exe"Expected output
9ffccb1991457539a5193127bba58337a5760ab4b462c3744cbd42d0371b5b28
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 2 of 2 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 2 on a recognised distribution platformThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 29.8 / 35 |
| Served over HTTPS | 2 of 2 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 1 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | GPL-3.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
The installer comes from a recognised distribution platform rather than http://xanasoft.com/'s own domain. That is normal for this kind of software and not a red flag by itself.
Every one of the 2 installers on this page comes with the SHA-256 http://xanasoft.com/ declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 95/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Sandboxie.Plus --exactUpgrade later
winget upgrade --id Sandboxie.PlusWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Sandboxie-Plus, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
054ED8D7243E87666A88C6C8BA999EB6B4E8031604A384944888A658B2ADA294
3FFFA720871F388B8AD4021F65BE222B9DFBE9EB8946D2B0A5A14BE475E22766
B2A786E62DCF67D8E67CE1F673B72EA59D0A9252611EADDF4DC2512AFAB6E6D3
F76C0645EAE9EE41D0C50D7E2950E0ACA50BF5B0448872955AAF73A2ADBF9AC3
A72F94368C95B9D03ADDDC99963CCD04A68E85EB1F6B139A70E3C536AD4495AF
9D845B6D1E7FFF9FD82DFDB00B3A90D060EF427638179E9225C82876B9B1EF64
14F2066A62C3F2952A3CDCEFFA8446E8C20D1F425D53AB86A19E52C99E282ED0
3114964C57843F3F9321A8E514E8EFBE29E0575289352E1424FBEAA3E9C5B2C5
7367889F2368F95B3A2289BDA6C2DC0E7C4E28C9087FAB58622B53ABA422B619
346ADE20BBFFA4EBD265FA09C79D229F07180D0F7925547F32B984300C647F0E
517BA8798154CC36DCB73969344479FFF0A8666961D459CC9B143AA60FA1F241
4E795159867260943A5D0C832EA80045BA883A12383065F09237BBC9A782DAEA
B3C4B0793BA321D422FF9E89D574181C3A119C562468562D9C4ED215E4D44DBA
88F72D409559F2C79ACCE164442AE2884C4B109EA53BAFDE658B0CF72D0E8D88
2069F29838BFA42404F19014929CA42B4EF5644670CC44B4AE78ADA377075A9C
E8E091EF2A06375C64CAC1A18DFD3BA6523E762EE66D0CD8CBAC1F3D76F13928
B7AB56C83F9F56F712D4E9CA57F5AC5A93AB11147805D0AB11F11B97D835908D
BDE888614C737F2C6274EE53200AD1BD4834A796318BCEB19A3F147F5E4B888D
62FD54E5F124A706D0A0339B9848110F368CFF0309ED8FB484529120AF220A14
63A15373B233CAA04D9796C3A40447F9898BF69E8E0226D041995A57F6396721
28E767B37836AA4BF4CD353AB9FDE841EA113C34199B0F2C96E002F39149010B
A7D6447CE3ADA8A0BC8679DA1F997DD0F73064F4E920D9EA1FFBBBB64D5D7236
435202099F37AEC373A9BBB6D734E71A7B567479A7A5AEF9A0AC55E3237159A0
E05D4894E6C3AB51FF653CF2C8ACE73018FD81F5D4A73B88D8F6022CFD3E8DC3
3B5971F24A22B4B88F0D1F637570BFFA385BA9300D5E07532869E53E19426E69
AC1EF93A5688C29F01A056F45D14EDDF7D8D3FDEC018AC17E45E5F5E16F05D54
A6279B8AD76E354CE5DD8DDABE6CBA3D1355317EAED5644E6917D5A225067B48
BE479DFE6A21D4DDC867C5262205D024A5028DB689A4A3C5D20AF49E0197FA5D
990ED291F350EDDDC98B8641BED2940EF415407F10964A7D2FB2D9553EB63999
E4672E38187C49E426B4CEC3364A08A0E535C96AF07DBC61C67AC81C9EC6C84E
055FEFC4F3EF7B45C3D07F0AE4BB083FDDA148C388A4BCE0154A47650EFF2856
F970D72FDFED418454E15DDA4F3DF67697F433A6F02F58CB2A151323A3FB6D76
77681E3C28E3DEF05D4789CC91356D06385912B2AF0509695F40A5CB9FC7E9D5
4AF40E928FFDCA8411AD63A93298D58498CA69B566C267F010A0F9DD9EE9DF40
E7AD3640E982E9C5525F58ADBAA167B7B641874EE64F00C7428C14E8D7E88E35
CF65796E93934E0BE691BC2BC27CE219F9215E1BB89398D6A6C177E4D3CBBB2C
01A90B0B9CDBBACC6BF505F8E6630DD07DCAF6227860B3126E6FEE3BDDE387AE
5CA3D472C49787875047AA4036C37909CBC9500F7807753B0702B8DC826B4F8B
88545C9EF4479C62522EB85038ECEB69EBF7FAC129C7B5973BDE009BCB830542
06C801528B8E0E456495019ABC77B43A7367D29DA88C227CBBA755C1946F320C
5EE96979809A09B5B19F9E9C20C732463A0CB26E40B0FBF745792915E8AE55E8
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Sandboxie-Plus version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Not related to Sandboxie-Plus — just other entries, each with its own official URL and published hash.