32-bit
nullsoftuser scopearchive.torproject.org · publisher domain- File name
- tor-browser-windows-i686-portable-15.0.19.exe
- SHA-256
- 6464e941baf60d5ba47fdd4fc3ef208bd0ae0bdb29fbd6a12591164dea4b7f34
by Tor Project · MPL-2.0
Protect yourself against tracking, surveillance, and censorship.
These URLs are the ones Tor Project declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what Tor Project published. Delete it.
Windows · PowerShell
Get-FileHash "tor-browser-windows-x86_64-portable-15.0.19.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "tor-browser-windows-x86_64-portable-15.0.19.exe"Expected output
0d4cc3a7b734a10c500217fb0df89452ee39185709193966831677bbd43c98f8
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 2 of 2 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 2 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 2 of 2 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 1 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | MPL-2.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions Tor Browser registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from torproject.org, which is a domain we have tied to Tor Project.
Every one of the 2 installers on this page comes with the SHA-256 Tor Project declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id TorProject.TorBrowser --exactUpgrade later
winget upgrade --id TorProject.TorBrowserWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Tor Browser, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
D522D8B93316A661B6471201FB26DCBEBA978618CD9629032442F5ED5224834C
0222D39AB5E0E9157AF1C5D8F01F79FDB6FD62EE337A671CA3F0CC6ED9AA1736
AE5E49067F756985AF9EFFB64C3BA1803AE2030C557D0A196F5B1473F54C52FD
13D3E0A229443B643C683DE1615456ACE7632F4D801B62720A9390AD953F8C80
8C06F3F9B8F1BE74B3AFBE08340F074133A13FE18175396590B8FF8547896EA3
F3228CEEBEF9A3FB82E97C41B93E3DDE54EB643703781252683EC463F6F626FA
F987806F8EF2C766BAB348DDD51A0236E52DA0222B4752E59AD90B17A34E57CD
BC33F30D25DB4CCF35AEEF90D5EE0D7D556C4B8F8A04D13CCAC50DF89223B6DD
3792ABFD6D4F1FED0F9092782CA4C73DF6A4386A5221C21F419510EBD53AB787
F4048FAEA4C26E0241104EBB6CB0979937532961737EA5D87E5387196A8116AE
82D85C0E4A3486F07E1F3D0828CA6FAA02E2E4F4E77FE7802797CDEB44663A6D
04DF90B475C3B21B62665D84F625359C8964AAF5E174624CD1EDA7A150D314CA
D82AC01E3BF5193EFB7AAA0BEB50621CD314628237F70DE5ED03A31B6641BC8B
856D7192969115523C1E93391FC3389D612B31CF01E155284FD8BF6F0E783CDB
2ADD3DB7C7BD29F94A149A52515070305645FABB649B3AB60C625E8EBA0BE996
3AE94669801D4C1370066C2322EB3BD58A4E3CD063DAB6670EA3EECF286145E7
3A09E23B9E0661BAF9334EF66C5859B25227EC972E608D14D1C9DD6116583F37
B0B015AEE358BC27521A84005A60A813C321030393403C03255450A03B06A703
F65D10ED7E4C209DC93A1F10529405A4302E252BA921FAF349554C2AB452AAD0
2F7DEA5CB68C538ED0CF257B5FE3F0E6DD4CDB82D065DD099C82790E2B101622
11E043679689B9D0E1084F8AB66C9A8136B42A4A0A815B2603B125F3379D4062
9E944E98CCB25186B9FD851938648D18EA2D65D77FD758383C5605ABAC9F1D04
B4FA8B74118A09E63C55C3C9FBA4AF39301056D1421527857EDFA2B9AB1A12BA
958626901DBE17FC003ED671B61B3656375E6F0BC06C9DFF60BD2F80D4ACE21B
62719D6FB8E1C6049D49E1E466DEE75BEF81503A743CBD1F6F53A6CE2435CCC2
FD0D4B77D1C1C911C7DBB00DE5FD53924D9D369641DCA640C6947103772D5AE3
CC1BB13BB9C3DC4F4A189C7EA9251156E09B43D4235BFB450F4EFD31A5AE1414
15448E951583B624C3F8FDFA8BC55FA9B65E1BCAFD474F3F2DFD5444E4178846
48A8C9CD3253F6635AF8D480FF1D92CD697FD71425D77AD3A0A858641DF4DE8A
0F363DDF43C8A6E627EC77D54823266EB1C1B35DF9A72AA941C94F23DEA1CF9F
79D66A5C9F7B6396494BEA657986467C85A08AFBB83579D53D4289311652B5E6
B0588A2BF8AC6A2A47EE4A06799360FC3DDC3BE251C8461AF2893AAA1E1F60FF
A44B527CEAAA6F94CFE6805FA9039AD8C45040DFA6BD705FF0075EAF34303B3C
C9EA87F9BFE704B83A1C8AF80442F41187620729DBC1468147595AB7F1C819D0
5A861A448B7500FC6E964375921A65A0882FBD394BF84C959EDFD18BCAD38432
66793F7208919A15087BAC96D8E31151FF53F9620D9FD7BFD340794FA6D5F86C
8479864ED1FDBAE7DA9155E761373A63110FCF45A029C953E7B88E6E11ACC32D
FD022504BB6E57E379668ED4B82966F284F19508DD88D76EAAF33E505ADD4F43
5289F9FBF146D8B2D78D7E3A12896DECCA8921E19427AD337EB094E63C2FF070
42175E455F814E5A691195C92DF92695F68BCA451AF53AE405D7A5129898AD89
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Tor Browser version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Tor Project and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Tor Browser — just other entries, each with its own official URL and published hash.