64-bit
exemachine scopedownload.virtualbox.org · publisher-owned- File name
- VirtualBox-7.2.14-174565-Win.exe
- SHA-256
- 5fb111f32a15763d519bf9ef23e0111153521f641cde7460e5b8e895ca27a1d2
- Silent install
- --silent
by Oracle and/or its affiliates · GPL-3.0-only
VirtualBox is a general-purpose full virtualization software for x86_64 hardware (with version 7.1 additionally for macOS/Arm), targeted at laptop, desktop, server and embedded use.
These URLs are the ones Oracle and/or its affiliates declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what Oracle and/or its affiliates published. Delete it.
Windows · PowerShell
Get-FileHash "VirtualBox-7.2.14-174565-Win.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "VirtualBox-7.2.14-174565-Win.exe"Expected output
5fb111f32a15763d519bf9ef23e0111153521f641cde7460e5b8e895ca27a1d2
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The unattended switch below is the one Oracle and/or its affiliates declares in the installer manifest, not one we guessed by trying flags.
64-bit · machine scope · publisher-declared
.\VirtualBox-7.2.14-174565-Win.exe --silentRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on a domain owned by the publisherThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 1 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | GPL-3.0-onlyA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions Oracle VirtualBox registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from virtualbox.org, which is a domain we have tied to Oracle and/or its affiliates.
The installer on this page comes with the SHA-256 Oracle and/or its affiliates declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Oracle.VirtualBox --exactUpgrade later
winget upgrade --id Oracle.VirtualBoxWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Oracle VirtualBox, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
5094F3D573FE2A511BFC7AE8982C2F6544AE9B5051048DC7A0E9985C74DCAC4C
F4750F6F64C44DF03EE2921DE77E63C30E84E03A3AAD07FD00F292265FF164C7
AE5415CC968C0E8ACDDD99358C21D267A2C31AC4FF5182861AAB9E6931001606
5194A1695D1B4C07D129E2B1E2088ADC3DD2F1F0F73699004375D6DFDFA60FD7
22988BE9792F39C8E07068504612BD83AAE8F8317E2AAF7515079F5CD9421675
42632E6F0B5F42B8252E91E01161FE2E0181167BC75C21B22E68E7DE7C984003
536F0ED5D99E8406A3D3B4B304C641507A581DFEBD1BC249C1C5323A873AF0BC
A7691470E3DBBEE6BA9FC0CC0073C9C64AA66DA69C99981214A35C5FA2621F5A
193DE3F5890B4653E2B05F95221C681F96749E7F10F7F38D1DDBD3895B3ECA70
F416694E26F260937CBC1C42D4E6050FD52A58152FE5BDA69E0DE204B34E81E3
35C42C98B784974A965C358A9BDA63B6CB4EDDE80DB83F87DAA2FEE83E6CFAD6
F970E275F59EEEB129AAB88A78DAE80784370742B5051650A7926C9EA64AFEAC
95BE216F865155F64CF461B712462405E25C600BD92B873D89AC43E8B564C15C
BC22F01478B51D4852D6A83318ED682CEE4D89FC9D8EB51B41988A67B04E7DE1
D6D4EB902221DE51C9CFF4BA5D41DCBC35CC1020B27E980CA8D4D80B5930E5D9
6C1337C8D0019ED60C388778150F74164C381CE0223C76498C5EDEF4A136873A
18F54B80A8CE0D2AA63AC986E97EAD294B013DFEC102646F89D23BA19A89C4B8
FA3544162EEE87B660999BD913F76CCB2E5A706928EF2C2E29811E4AC76FB166
4C83894C00AA9F55F7E0F70807210896BA32E1222D4FF1D0B9487AF81F328F36
4719B38E7A276B43099CE4D6349E6BFC80EDF644EE59D9DAFD264BC7ED7691F4
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Oracle VirtualBox version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Oracle and/or its affiliates and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Oracle VirtualBox — just other entries, each with its own official URL and published hash.