32-bit
zipgithub.com · publisher domain- File name
- ventoy-1.1.17-windows.zip
- SHA-256
- d250e97a7595fdac4f97debc630d7a8da942319274a76cb32384596b659dbaeb
by Ventoy · GPL-3.0
Ventoy is an open source tool to create bootable USB drive for ISO/WIM/IMG/VHD(x)/EFI files.
These URLs are the ones Ventoy declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what Ventoy published. Delete it.
Windows · PowerShell
Get-FileHash "ventoy-1.1.17-windows.zip" -Algorithm SHA256macOS · Linux
shasum -a 256 "ventoy-1.1.17-windows.zip"Expected output
d250e97a7595fdac4f97debc630d7a8da942319274a76cb32384596b659dbaeb
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 4 of 4 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 4 on the publisher's own domainThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 4 of 4 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 1 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | GPL-3.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Yes, in the sense we can actually verify: the installer downloads from github.com, which is a domain we have tied to Ventoy.
Every one of the 4 installers on this page comes with the SHA-256 Ventoy declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Ventoy.Ventoy --exactUpgrade later
winget upgrade --id Ventoy.VentoyWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Ventoy, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
7DB5B3A1E23AF39D0A648843C263EB5CF51493CCBF2A38C6A4315DB80A4F9B58
D5AF29281BA8B57D7C398F452D31A5D031F6DCB460BDB0A67B2115DFEF372B76
3DC0BAF85A183BB8FC72B49EA0646D259984C37B6A6DC61CE7087FE8CE187075
E70C505BE08D99C55E506832F596C430A9C36F8D087F25542D3F6D332D9B6473
1E56E02FC424C194FC4F33357CB949867854F386D67EAF9764F1C96264561493
C65E6BFF33A376BD3FD3243EB9CDD923C07F7D051C934C7B6AD72F7BF6C80049
FF531A78D60C604CEE67D56D02102A1147E647D0FB8FB8516F77712D05D5B99D
2EEB7553E62A940449A42B59EDE3B4D3550023B2FF864A297DEE818086E3564B
3E7A8DB199C7E791E341E6D388D078BFC6B7A77C6F10282EDF9C7B82F84F3AD4
CE192B6C3BB144F3F5E850B1DF3E90457503BADCC959581EAA46BE9FCC9FA8E6
3DC1F0A5209C6FA260AF9F08951BC4421127B56D4EFA3EDD2C979AF74B1941E5
B2E71DFF6796F9EBB6867B6FCCB1F9FDF27EF6E5F6893952D8046BD17B6A51FA
F992FB0569A2F9EC057C7D97800A13EAD7ACC57A758953800D8D958D0AE471DC
C088BA56B2D7E05546825380288FAA6EE20600652B4FD1D8F78424DEB76D76AD
04AE8EE05F9D7BE532817E7D6736111F470E416860DC0A42561BB5083457D38E
578993FCF8D57252BC34536C01DC853A374E60DEF68F60B2826C3DE0826EA00C
8A21ECED5EFEA22A82B2F8B2783A7DB2449C09EF0A4ECB0FA4D019E3AB06E0D1
44FB53F26872C6304E1CB3D47B65D0613665666100C48DEEEE4CD87901FB500F
C37D333BC630076679172CF1934290C3C7C80340A9719369B96628EDBDCB724B
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Ventoy version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Ventoy and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Ventoy — just other entries, each with its own official URL and published hash.