by Mozilla · MPL-2.0
Thunderbird is a free email application that is easy to set up and customize - and it's loaded with great features!
These URLs are the ones Mozilla declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what Mozilla published. Delete it.
Windows · PowerShell
Get-FileHash "Thunderbird Setup 153.0.3.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "Thunderbird Setup 153.0.3.exe"Expected output
f8078deceb1f80b05d75eec92399ce01ab3027fe719fbe2aed612001bea24ad3
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The unattended switch below is the one Mozilla declares in the installer manifest, not one we guessed by trying flags.
32-bit · machine scope · publisher-declared
.\Thunderbird Setup 153.0.3.exe /S /PreventRebootRequired=trueRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
Silent install commands for every program we index · silent uninstall
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 2 of 2 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 2 on a domain owned by the publisherThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 2 of 2 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 0 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | MPL-2.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions Mozilla Thunderbird (en-US) registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from mozilla.net, which is a domain we have tied to Mozilla.
Every one of the 2 installers on this page comes with the SHA-256 Mozilla declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Mozilla.Thunderbird --exactUpgrade later
winget upgrade --id Mozilla.ThunderbirdWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Mozilla Thunderbird (en-US), each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
5D315AC21E9143505B1196E985A54B73E0058642C7D5F9C7C020BED5192FBA5F
AAA4FBE7E605594C5D75D5C97392E7226C77ECC1683ABFB7F26B81D1A1D5DA1E
E22343C89A38FE686228C3E1C823854269E7CED864475ABE9F88D1884FE1F707
744A51965AE6FE36A7EC660D8C080FD108CCA732E9AEC3F9A31324321C6BE1CA
C08D1F946B19E89C5776B33A6680663A114FE5A878E1BF67FBD53ABC60E2098D
A20B2C70DCDD4B6E4B419EAC0DC11C97FA688202182587CCBE79792D78607A73
F94B9918955AD39673BA125A383F34F9963F2B44A0F2B30AAE1439D4B0BAD2A3
8AC6473B18AA31BA2331C0C9C7242BDDBBADC1F87CEF077056BA953003A2FCE9
0E9239E205FE7E37D579C5E0A8F2C36D33D690A809F3C5C80249F735DAC079D2
4F50BC0C5138F44EC6D61D7412675334712C04E4DEFECCD38BB61A0EA444DC37
B8684F66E926F6A767B65CB5EA31F4EEAD9530D31F1334E360F32D19389DE092
552D33F9B1B7A35BC04C64EFA1AEA3439E47D6889F1B85FEF0534772AA1154C6
205E7F9FCDE2CA815EE7ECA695C160C954758039E9FDB15621E7B7CF8B1AE649
F4B6C722627967FF17FD96DAA0CADEA5FFE1B95FB280AFC670D3FD2A46944DCD
AE176A579D42DDB45552A8B37F618B3BEE3E2F74021F9EA68A231FE6B8BB645C
D2780ADE9361AC1A5358C15A5E119F3A117CDE6D185BDE0476E0249C0EC16B0B
58A0DBB5FEA04163A1A3DDE775D71AACB456F15667AEE6CCC58DAD7C31E28362
5A3581A8FAE3BCCC4B6D62F53EB7D6A64E2EDF74D2A57224EDE9B79F122C76F0
625C6BED85EC45FFA127E6D6A87484072A3D4C4C8F45E02A7E7B80DED96EED86
D60A4D724669D34C87CA61425DDAF08FD5284F54D966CDCB1D523F732B9AE300
8E567734DD40CF262FE77FEE891CA544D42EED8C3822A26983A47D5F764341A1
D1F8698853AC99477AFCFECA240064D19871857E425DAEAA07A57BFAEDCA628D
916F68ECFB8A46827019CD31D3BB4514A90578ACAC2167F3FD4B62762C3F4092
2BD04B5A0714390C1DBBD915264E6625710E41EC99B36A3115B7FDB8AFC54DE1
9A5D4F04687CED9DE42A4DA5560A64E193E536528B6C7DBDF0B56983BE2E15B7
8531249694699CD50659E818FFB7D4F578C5C998D839F821004B6F19FE3E2A1D
98F2C235BA3DF1DB47BD912EDE2170FDBD308173E1A6216CB112228B32734481
AFC796448B761182F42881FE34EB7AA95AD9DE4E1B53B9965DEECF614FF44621
9E33EF69B3B2908D1005F3A5ED07CBF7AD44BC894BEBB74B4920B5A5A7A1A6CF
8DD53CEE495ADB2D88C23516F0D620B22176759E48972F29AED59EDB0B62EA41
C4601BBAD5C2A194BD13E5387776EBCE1E73E17173293778C9AC1AF47520EE1C
C696DB24648F0123AE387F9AC21307034707348D13BD82D150CE775DBAEEAF17
6F6146700ACE07B9EC8BD19DB85C4562BDEDCFB72B70F8850E66180938045B9D
9423706CD055A82B1CF80AC7A2667268148E7A605F65D4CF5BB0383421A7AC1F
99E17A576D21E4214D9DF63733DCCF4E34BEF534768CA76BAF148C40D5B6716E
91D1AA789911439A671DDC7D4F97FDE6E4160242828560942E5EB38A6BE39351
DDC5A87C6BF02BBE86B6BA823C92E713BBAC479B238136A319AEC78656349189
EF7183EFD37CC7C69D9B5F11A41DB72B23F3E669D223AB08404A4A05D434E30D
CE1185531A207578E7CD09EDC46C49DD287DB2129BCED537D176A9DBDCDC97B8
7E0C22721F3B822AE962070152847E1A499C7772D694E191C154868BCC58DF38
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Mozilla Thunderbird (en-US) version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Mozilla and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Mozilla Thunderbird (en-US) — just other entries, each with its own official URL and published hash.