32-bit
nullsoftmachine scopedownload.zotero.org · publisher-owned- File name
- Zotero-9.0.6_win32_setup.exe
- SHA-256
- a95c7e3d570d495f7f90f7d79dd1aa6079a71b72ba11a65502e883c622d71d44
by Corporation for Digital Scholarship · AGPL-3.0
Your personal research assistant
These URLs are the ones Corporation for Digital Scholarship declares in its own manifest. We do not proxy or shorten them, and we do not host a copy.
More than one architecture below. Check which one your Windows is if you are not sure.
Run this against the file on disk. If the output does not match the hash below, the file is not what Corporation for Digital Scholarship published. Delete it.
Windows · PowerShell
Get-FileHash "Zotero-9.0.6_x64_setup.exe" -Algorithm SHA256macOS · Linux
shasum -a 256 "Zotero-9.0.6_x64_setup.exe"Expected output
973bfc96a7af8b2949bbfdc46b220366b2b204942ac30d50aef9835eb152d31c
Got a different hash, or one you cannot place? Paste it into the hash checker and it will tell you which program and version it belongs to, past releases included.
The macOS build as Homebrew declares it, with the same treatment as the Windows side: the publisher's own URL and a hash to check it against.
| Signal | Finding | Points |
|---|---|---|
| SHA-256 hash published | 3 of 3 installers ship a SHA-256 hashWithout a published hash there is no way to prove the file you downloaded is the file the publisher built. | 30 / 30 |
| Binary provenance | 3 on a domain owned by the publisherThe strongest signal against a repackaged installer: the file should come from the publisher, not from a mirror nobody vouches for. | 35 / 35 |
| Served over HTTPS | 3 of 3 over HTTPSAn installer fetched over plain HTTP can be modified in transit. | 15 / 15 |
| Release recency | last release about 1 months agoSoftware that has not shipped in years accumulates unpatched vulnerabilities. | 15 / 15 |
| Licence declared | AGPL-3.0A declared licence tells you what you are actually allowed to do with the software. | 5 / 5 |
Extensions Zotero registers itself to handle.
Yes, in the sense we can actually verify: the installer downloads from zotero.org, which is a domain we have tied to Corporation for Digital Scholarship.
Every one of the 3 installers on this page comes with the SHA-256 Corporation for Digital Scholarship declared, so you do not have to take our word for it: hash the file you downloaded and compare.
What this does not tell you is whether the software itself is any good, or whether you want what it does once installed. A publisher can ship something you would rather not run and the download is still authentic. We answer the question we can measure and leave the other one to you.
If Windows says “Windows protected your PC” when you run it, that is SmartScreen reporting reputation, not a malware verdict — it shows up on perfectly legitimate software from small publishers and on releases that are simply new. The reverse matters more: no warning does not mean the file was checked.
How the 100/100 score is calculated · why the source matters more than the reputation
Windows ships with a package manager, and this program is in it. The identifier below is the one Microsoft's repository uses, which is also where the download URL and hash on this page come from.
Install
winget install --id DigitalScholar.Zotero --exactUpgrade later
winget upgrade --id DigitalScholar.ZoteroWhy --exact: without it winget matches on name as well as identifier, and a search that returns more than one package makes it stop and ask rather than install. Pinning the identifier is what makes the command safe to put in a script.
Not installing anything, or getting an error back? The commands that actually come up covers upgrading everything at once, what --include-unknown is for, and why winget can be missing from a machine that should have it.
The version history of Zotero, each release with the download URL the publisher declared at the time and the SHA-256 to check it against. Useful when an update breaks something and you need to downgrade to a build that worked.
We do not host any of these files and never re-upload them, which is the difference between this and an old-version download site.
AA5F08896C9A30EE21652FEC03B54F7E8569BC4AEB6DDF3640C528F073B97372
22831E3E0990CFDB38FC9986BFC01C85EA4A02B33F37F6EC4699B0D9332F0499
64126CE6B07EB38F6DD6F08ED8AC3A9F49F378710B017BC63556B38D6C2C9E06
23C5A2A5DC8E3E881722F59304111BBD50274E8D3327641A4E9B706AAFBDB2A8
73BABEB15196017BAFAAB7C0EFF2E719A8CCBB651417D5E797250E554C7E43EA
24E2C441CDD9D7820020F1A1A22C28373F5A83AA9AE031E9CD947705190E2AB0
2327B1014C32EADA07EC83620586F419A2A4CAD23B9B98DA042189340590BCF1
3D3668869FD6F9D5B2F4DE8C7F3955DE77097924B7C5A8816DB0425089C05FB8
5A7534BA45E2D0A506F25415E5E15AF8A7801EC243F71EAC00EE660756913C33
113A20CF4B70B471D3F598A25F2CCA0BE7382658AEA9586874F137EE048F55EC
CF311861FF1AF3B42E0750B48090492C034A8EE614A77F9E9F12BF05E0DE51A9
D6DBE06A4E1F3408E038D43EF2551B0E9C38C7C31A8783D8FFE92B8B7326790E
F7C8188C53838BA90CDD2148B273621A8E6B0809E8F5CC9BA4A9289E44DC6B0D
531CE0B3EBDB4E25266D149BD88B835CE1BC0C801FC58385845C29C13A4D9314
DB105962993C950D2EAB36C8928EF5865C6A7E556ECA688ECFEDD84DF5E3F3C4
DDDB69BEF32A3A52E310EF50090860977A468FFF92530597509BCB0F35EC5693
938B66DDC28F60ED4B23BD53D7DE72F6CFEB00D5E2006EC56D57F38A16EE1C8C
580C61C5D3B7045755D592724F5A056FD77FA92359A77999DFC9BCA7FBFA126C
084348EC8FB94B4B6D9DCFB1E2D3FB4511215B9BCD8FA3C9CB3EE23C2FD253EF
43632093FC0C59F30D94E312B8B8AF2F68D4D529458B0BE7BBE1FE629F1EDFAA
CBF5B5F99DC8D360ECFA378961825BB64F428F886AD7E3D9F14D2587D102F8C6
73B38EFB71A73B9CCA5F5EC9A75F0B401733D004E9EF9E872541BCE64DBBD9A8
1FACAFBD82B3EEFE3C162EA2DCEF3BFAFF05B9EEDD804DC55F65D0E03ACB55E6
445518F7CD6761D0489EEC55EB89346EF2A1FA54FCA0CBECF4CAA73A5663636A
7FBB414B70CA4557DFC7105F74A470F71A935FCD0BA6130769BA6C96D3BAF679
190A746B691F409EBCA4C53C4AA2034A425A89A8C461DBAA17E0AA40538CB11B
0EFC973709A472FD33F60A7C19EFF1E21FB15D06E41DD789FA1943D7C3FCFEFA
B99D2D96DEA62B5D4F3440763A39C2AA674D1075902CB078C594962C1C7E8ECE
C013D9FF634461544DB87BF70A96083797588B49BF57C236C7B20DF3CEC1B638
74B09BCC063F0BFCCD8B2AA58FE3EB17EAA87DDB2FF92A5EA2FAC63A88D3E279
BD95F57D7C2941D4E48DAC3ADEDED2410A0A763A1E395A57EEEA43D9090F5505
FCEA1BBAE0775AF8BBFA8D7481827050F017D0B1F99AB9ED225F9B65EFE5BD03
06B60DD065C50947647E0D59AE3D26D013B88DA6DE79013F2699F96A5F230211
46D6858E48DD7F9D106CDC18A28015CFCCF0DB357079FA7502FB4F3AAF7CF0A7
21FA7F3B632089C8FC7D391F36F5B3C2B063C9BF1CF2315200F4D79A955B1646
52B357AD3FFDAE3B2D771DEFB01F36917E5D6A9E1E79E1400216F8AA54213B32
05290FDAC7BCDB01F5FF3ED6E4E0532E199F8E1945AA85A7DAE0A29282B4980E
5901B7C198670C6D8ED3763F231EF89EA6D51055D1E7082D6C50582855336C0F
D49BFAC029E3551A08AA874FDE970BB9A4DC1BF16C7F4997480AE2D991F938E2
E971CCAB29ABA3D3ED311E9A98D46DE9A2921C50C70F489126CEFD74B4D85F31
E363F7FAFC41A7D966270EC02027D937415E46D8A7E1960675AC856110A239D1
D0918624E668D0B752844B658E9786EAF5804E0AD0C1F865B5DE226CA9D7292D
B4DE21B19EB612C301CC43269C873EB8536FF16DC817BDF8A7CDB99927CD28D0
991F5180BBCE6D41393EC8A0BDA0042E909DFD41FF0FEB45597501041ED1F289
894EEB5C245265FE845B2932A70098FFBE16D7EF212ED8245B6711E3A4DCAAAB
C2CD387D7DD60CDCBF882F94A50F56E5584D4EFDD6B33A7EBBF9B6595E119EA8
34113D8532DD96138064933F161C60593A0C7FAF80F82D16FE05A9F75B8121D6
1115011D972736C7CDCE167602F16CC4AEC857B7E2C793A3CED0411C8509C6E7
AFAE9BE92FE4E4FE04BA52D4EFB667234C43090DBEF8F6DBFD158CCCDE9E90F1
8465DC1BDA2904E751D8C6B14955F6A4FCE50EB17B7CC03ECE1EB2CB05D8F54E
DF17E9ECE10FDBD944A689E17FEBD3D949AE70AC7E8E3CB80428BDF6797CFD7E
F9B4CAC87837C9AE70B3A5F0BDBC2816B8EF7EFDFD727ECAB9D86DBEE335EC2E
700642D797F4D258EB6D7B5D2BED152EC66F53CCA0C3EA7DB48493413F5681A5
A5F9E9C9F44DED2F269A8E659F698AA08E0709FC679CF50B0429DE0B7B4225C7
B299CA3CB5A6F2067A35B35A94370B476413623A3A4CFB140869DC861924DE0D
74B685354FF23B9B8261DE3F8B741CEE6937F3DFA0F687A99EA3FBF656729659
492356BE42E90C6BDCFF76A087D2CE2458D81ED3AD14A8948FCEE4C59B946833
4236C45506B9BCC99C41232674528F2B21583F172D93DA52E1EE41A4DEDC5A59
673D5D4D0750AA6612E897272C392EFE14379D5039492419E69150F687E5F64D
32E550BCB0369062C149262DCA664D9B35D3251D36712B27B060437155E780DB
The file names, so you can tell what you have. Their hashes are in the hash checker and in the downloadable archive.
Publishers take old builds offline without warning, so a link here can stop working even though the hash stays correct forever. If you already have the file, the hash is what matters: it tells you whether what you have is what they published.
Every Zotero version with a published manifest, newest first. The most recent ones are listed above with their file names and hashes.
Not related to Zotero — just other entries, each with its own official URL and published hash.