64-bit
wixmachine scopedownloads.cloudflareclient.com · publisher-owned- File name
- 2026.6.905.0
- SHA-256
- d6c58ac9c18e2459d7173cf071812ebfdb1014ac6b9f041f4e1c37c7859c20f1
by Cloudflare, Inc. · Proprietary
1.1.1.1 with WARP replaces the connection between your device and the Internet with a modern, optimized, protocol.
These URLs are the ones Cloudflare, Inc. declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what Cloudflare, Inc. published. Delete it.
Windows · PowerShell
Get-FileHash "2026.6.905.0" -Algorithm SHA256macOS · Linux
shasum -a 256 "2026.6.905.0"Expected output
d6c58ac9c18e2459d7173cf071812ebfdb1014ac6b9f041f4e1c37c7859c20f1
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
This installer is an MSI package, so it takes the standard Windows Installer switches. That is a property of MSI itself rather than something the publisher declared.
64-bit · machine scope · MSI convention
msiexec /i "2026.6.905.0" /qn /norestartRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on a domain owned by the publisherThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Licence declared | ProprietaryA declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Yes, in the sense we can actually verify: the installer downloads from cloudflareclient.com, which is a domain we have tied to Cloudflare, Inc.
The installer on this page comes with the SHA-256 Cloudflare, Inc declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Cloudflare.Warp --exactUpgrade later
winget upgrade --id Cloudflare.WarpWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Cloudflare One Client, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
FFCD1D803D774409AE54E565E85B7E03CD96450FD1654EEE44F8A9E463078030
C8814ECE9DD91948FE4080F8D1DD08AF328D6DB98656D118F043E6B94E222A56
94891939F216812D638C0190B83D70F64ECC67A19AC213A79B6624A19150E6A9
40EE1DF774131155EBEC51544BB714442E52102B44C3009FE8F2198B82A86394
F4FFF7332C23642BB6E1DD34FF82A2EBB8F9A58379B7B4819E6FA5170E2D84A7
381178D3A2EBB0AAB4C11D2125F2FA247FFECCC561B4195155901C4B60E3941C
D15378C2BFC6AFA768D631B410407E3FC2B0F2EE3F0E84E252C74FD3600524CC
599C7E3F79B4098928624DA513B0594E76D4417F273BBDBAE9B44F0D00624A45
AC519BCC2937D93D67D31497D72A6262801D30CEA98894A9584C0B92D0635BA2
DC912D37335C6B92F8A948534047DB204AFB3504C61C2B8355C5E2F893300D9C
DA11F5859D120C3817D903209F2980994236D07AAE18B49F72CEFD81221B6BBB
011EB387AB6064AD3FC18321A377FCF6D8A9BD3B03B22208D05F3BB9965C0633
3D639B829381A4A006E8368ED800DD6B3A8F3FE36E39FFC346DEF029335CF8C0
1642F47F059952E6963456C449174D7EB048C5E55AD95750CC73DFE26701FD86
FF77A76288ADF412E819614795476B9B834B79E5A036AAA554C6E2EABD45C623
04108B020B545F778D6BB7EA996A896D5E30F722A1FDF056FE74001228C1FEE5
26BAD679B589A3ED1A2AE501F22C7A7297159B31C5FC76D28413C4AB3E787828
ABADABC597EC33ADE211D161936CB17D0E7FD50F43208D23AC29B4F77FD8A855
4806438FF1B8B86E62338E169095C0127F9AC5A41609FF74C37EEB6EB407C930
5D3D2FCCA081DE37A4CCFD8B29D7420CEF852B6171973C4F047C96731E1DD566
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Cloudflare One Client version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories Cloudflare, Inc. and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Cloudflare One Client — just other entries, each with its own official URL and published hash.