How To Verify a Download Before You Open It

Right-click the downloaded file, select Properties, and check the Digital Signatures tab. If the signature is valid and from the software publisher, the file hasn't been tampered with. If there's no signature, or it says the signature is invalid, delete the file immediately. That's the fastest way to verify a download on Windows before you open it.

Why You Need to Verify Before Opening

A downloaded file can be a perfect copy of what the developer released. It can also be a trojan wrapped in a legit-looking icon. Torrents compound this risk because you're downloading from unknown peers, not the publisher's server. One bad peer can swap the real file for malware. Verifying a download takes under a minute. Cleaning up ransomware takes days or costs you your data.

Check the File's Digital Signature (Windows Only)

This is the first thing to do for any .exe, .dll, or .msi file on Windows 10 or 11. macOS doesn't use this system for downloaded files.

• Locate the file in File Explorer.
• Right-click it and select Properties.
• Click the Digital Signatures tab.
• Select the signature entry in the list. It should show the publisher's name, like "Microsoft Corporation" or "Adobe Inc."
• Click Details. You should see "This digital signature is OK."

If you see "This digital signature is not valid," or the tab is empty, the file has been modified or is unsigned. Don't run it. A valid signature means the file hasn't changed since the developer signed it. It doesn't guarantee the developer is trustworthy, but it proves the file wasn't swapped for a malicious version during your download.

What About macOS Gatekeeper?

macOS checks notarization automatically when you try to open a downloaded file for the first time. If macOS blocks it, don't bypass the block in System Settings unless you're absolutely certain the source is safe. Still run a checksum check to be sure.

How to Match the Official SHA-256 Checksum

Software publishers post a hash—a fixed-length string of characters—for each file they release. You compute the same hash on your copy. If the strings match, your file is identical to theirs. This catches any corruption or tampering, even if the digital signature looks fine.

On Windows

Open Command Prompt or PowerShell in the folder where the file is saved. Run this command, replacing "filename.exe" with the actual file name:

certutil -hashfile filename.exe SHA256

You'll get a 64-character hexadecimal string. Copy it. Go to the software publisher's official download page or a trusted repository like the developer's GitHub releases. Find the SHA-256 checksum listed there. Compare the two. If they match exactly, your file is authentic. If they differ by even one character, the file is compromised or corrupted. Delete it.

On macOS

Open Terminal. Navigate to the Downloads folder (or wherever the file is) with cd ~/Downloads. Then run:

shasum -a 256 filename.dmg

You get the same 64-character hash. Compare it to the official one from the publisher's website. Match means safe. Mismatch means trash the file.

This works for any file type: .exe, .dmg, .iso, .zip, or .apk. Always look for the checksum on the publisher's official site, not on the torrent page or a forum post. Those can be faked.

Use VirusTotal for a Second Opinion

VirusTotal (virustotal.com) is a free online service that scans a file with over 70 antivirus engines. It catches most known malware and PUPs (potentially unwanted programs). A clever zero-day can still evade all of them, so don't treat a clean result as a guarantee.

• Go to virustotal.com in your browser.
• Click Choose file and select the downloaded file.
• Wait for the scan. It usually takes under 30 seconds.
• Look at the results. You want "0 security vendors flagged this file as malicious."

If even one engine flags it, treat the file as suspicious. That engine might be a false positive on a legitimate crack or keygen, but that's a risk you shouldn't take. Delete it and find a clean source.

VirusTotal accepts files up to 650 MB for free. For larger files, use the hash search instead. Paste the SHA-256 hash you computed earlier into the search bar on the site. If the file has been scanned before, you'll see the results immediately without re-uploading.

Scan With Your Antivirus (and Which One to Use)

Windows Defender is decent for real-time protection, but it's not the strongest for scanning a specific file you already suspect might be bad. For manual scans, use a secondary scanner.

Malwarebytes Premium is the best option for this. It costs $39.99 per year as of 2026 for a single device license. It catches adware, browser hijackers, and trojans that Defender sometimes misses. Right-click the downloaded file and select Scan with Malwarebytes. If it finds nothing, you're likely safe. If it finds something, quarantine it.

You can use the free trial of Malwarebytes, but it won't include the right-click context menu scan. The Premium version adds that. It's worth the price if you download files regularly.

Do not run two real-time antivirus programs at the same time. They conflict. Use Windows Defender for always-on protection, and Malwarebytes Premium only for on-demand scanning of suspicious files.

Verify a Torrent's Integrity From Inside Your Client

If you downloaded a file via BitTorrent, the client itself can check that every piece of the file matches the torrent metadata. A partial download or a corrupt piece will show up as an error. This doesn't verify that the original file is safe—just that your copy is complete and uncorrupted from the swarm.

In qBittorrent (version 4.6 or newer, free and open source):

• Right-click the completed torrent in the list.
• Select Force Recheck.
• The client recalculates every piece hash and compares it to the torrent file. It shows a percentage. 100% means every byte is correct.

If qBittorrent reports any errors or missing pieces, the file is damaged. Re-download it. Torrent clients other than qBittorrent have a similar feature, often labeled "Force Recheck" or "Verify." Use it before you open the file, not after.

Force Recheck is especially useful after torrenting. Peers can seed a corrupt version. A recheck catches that instantly. It does not tell you if the file is malware—only that it matches what the torrent creator intended. You still need to check the digital signature or SHA-256 hash against the publisher's official release for that.

Part of our guide to The Torrent Client Handbook.