64-bit
exemachine scopecdn.waterfox.com · publisher-owned- File name
- Waterfox Setup 6.6.17.exe
- SHA-256
- f59df2fd152afd476ad941a886a61878fec17b70d224197b229230a12e50c468
- Silent install
- -ms
by BrowserWorks · MPL-2.0
Fast and Private Web Browser
These URLs are the ones BrowserWorks declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
Run this against the file on disk. If the output does not match the hash below, the file is not what BrowserWorks published. Delete it.
Windows · PowerShell
Get-FileHash "Waterfox Setup 6.6.17.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "Waterfox Setup 6.6.17.exe"Expected output
f59df2fd152afd476ad941a886a61878fec17b70d224197b229230a12e50c468
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The unattended switch below is the one BrowserWorks declares in the installer manifest, not one we guessed by trying flags.
64-bit · machine scope · publisher-declared
.\Waterfox Setup 6.6.17.exe -msRun it from the folder holding the downloaded file, in a terminal opened as administrator when the package installs for all users. Silent means no window and no prompts, so check the exit code rather than waiting for something to appear: 0 is success and 3010 means it worked but wants a reboot.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 1 of 1 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 1 on a domain owned by the publisherThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 1 of 1 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 1 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | MPL-2.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions Waterfox registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from waterfox.com, which is a domain we have tied to BrowserWorks.
The installer on this page comes with the SHA-256 BrowserWorks declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id Waterfox.Waterfox --exactUpgrade later
winget upgrade --id Waterfox.WaterfoxWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Waterfox, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
D70B78977B3C2E908F0747B9D2B160DEBAF0093B6E735E6D9A1C6E5C10B4D0B5
B85957C5D6E3FB8E7775E2FF7D259A7BB8FF7DC1FAF75149FA748E0012A337C2
65CC8C1150EC6587BB75EC3FF83314C6F82E7D3A426E892F7906637482FD8FEF
228AE1B8A18208058D4A30BB136ABC9F5B38C838512300CC08267EF2F8FFEA17
4451F53EE2A6421559DA4FF7D4BF5DC41A42CEF4E7E22984AAD1A591B4F76E98
51C46AEA4066371C00CF1765C99BD551B7CC5E22C27F7E397F231A33E5DA3DB0
33A51457140B88C22C5879061A67E24B937A4941A146178D4D796BCC68E7CC51
58D5EFE853C745EC7BF5497D432B62BD3103AF5E9562312104BFFD87695836AA
8D68148958CF2AC287E21ADF2DB753086A89C96F3FF448423665EFDF79F10C4F
0C20D781EE5529AB7208737F8983601D7199904262F8E23665A9B06A9ED5350F
F4F169114C1C6C6268D128358BCB6DD2F855DC12E7BC5FB25B9C0A5B0C2DFDD3
51EEC316DF6B1BD06F75BA215BA8ECFDB81D4941A3712CE37D397315C493DAAE
D09768D2164DED9A4612EE152E642240E108D7B6A6DA48D9F109B589B87F28CB
38A2884FA0B42C426555C6AFF2BC81A6DD7CE236AAE6392371FEE481CEE1F8CB
A26778AC6DF17B2347B38E64E82AAF93EC3724E2F507EF0C7E97CDFBEAF296C2
070CD03171D69B4B963B92B927C6E8477CE8FD7B9B8A1BEFCB0FD015A75A98F3
2EEB25B7EF6156AEB77983080B640A288D78A16499B872095C6F2F9BF505611C
36AD3A4EC62BB088330AD9AEF8234D0056AC81D603095BF28B87F35D0550A9D5
36C0D264EB852AE0735517BCB9EB7EEE2DDDE170C5E25369713EE5AD5E25AC98
2CF65DF5DE83DF0F3DC6AC7A2FB9744E3D87EC96094F586C0DC1085B3249E12F
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Waterfox version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Matched on the categories BrowserWorks and others declare in their own manifests, so the grouping is theirs rather than ours. Each one has its official URL and hash on the same terms as this page.
Not related to Waterfox — just other entries, each with its own official URL and published hash.