64-bit
nullsoftuser scopeupdates.signal.org · publisher domain- File name
- signal-desktop-win-8.23.0.exe
- SHA-256
- fef0b120d23e5ad7c2c0336cf2ceeccc511505cd990e4fb9be931df5b26260a9
by Signal Messenger, LLC · AGPL-3.0
Signal is an encrypted communications application.
These URLs are the ones Signal Messenger, LLC declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what Signal Messenger, LLC published. Delete it.
Windows · PowerShell
Get-FileHash "signal-desktop-win-8.23.0.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "signal-desktop-win-8.23.0.exe"Expected output
fef0b120d23e5ad7c2c0336cf2ceeccc511505cd990e4fb9be931df5b26260a9
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 0 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | AGPL-3.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Yes, in the sense we can actually verify: the installer downloads from signal.org, which is a domain we have tied to Signal Messenger, LLC.
The installer on this page comes with the SHA-256 Signal Messenger, LLC declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id OpenWhisperSystems.Signal --exactUpgrade later
winget upgrade --id OpenWhisperSystems.SignalWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Signal, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
B2BF0E60ED5D4757915C51FB2ECB49E2B26C2EB4A260E5AF2875F0F35A9B27DA
441E24C4FF3AE498D29B048534EAB0254A04836942E72B9A2AB2527FF66E5CC3
717A504D31DDBF449A0DC80C60E4AC50E3085244FBBF0AD7FA0CD301D5982F50
95BB1F448C684466D7FB50BF6499E1272036D9E7F34087BCB2AD0F13E8E9102D
7C33B91D430151A42B28268F22777D1271676F7322E56F54F89C8F4E29D17B5C
EE8FA68BAD3D9FC100FA98862634FCC825C2224BE267767B6E8B72C195A80708
750812F794C5DE74E5B544E797F3A6A84AE8EECA23AE34C8CFC4696C97B5E60E
098665DC1416BBDEA722AC8B78827F4C8121C0D84C2D04A5D9E0E403A2DDC71A
D10BAA413FE974CB4265DEE07667F1371F01673DEB7581CA3755649D143B2FE1
FE4F49F43CACA580154EC29E8D391337DE88359C4C83816715C2BFDD332CD032
EF3E3BC288C8B44B3FBA0D045C7176651455991CCB574545F04F25FDA08153AF
D33BE179298E2A450C4996A7C3423D5FD350A599B54D69A8865EFEC40DAFA7B1
602BBC9D946C10B34D66378CBD2F835B8C7BAED870DCEC56C03BE08C19C32EE2
3B3A9654DB548653EC3045BA8F0A3342EEB2D5CAFBF70C97147D2EB4EF00D728
801EC50002BD0AAB90D55275F52FD7F13D2ABAE537F5E05E16CF20AC56D674CB
8155E0815DC59B435F3C58ABCF219F484B5741A07D510D75CF862BB2225AD22C
BE857DF5BDBB9036149F01CB60B879CB77FD33ED7301E42255B1AC8EE0845F98
EA08F41501F3815D8F37A1C01311DE90A055DF21796E58938B1CB6D1C07B5746
21E98214BBE55ABA0B7BF9DE321F965BD44DD62BA9390CD700E5CEEC98F195E7
357A5E660DCFAC80994ECB43CEB8E6BA52D2C753C99CD1BF58852099E03DB4ED
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Signal version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Signal Messenger, LLC and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Signal — just other entries, each with its own official URL and published hash.