Windows: check a software download’s publisher and signature before running it

Check a downloaded Windows installer before running it. These PowerShell commands read signature and hash information; they install nothing. The guide applies to Windows with Windows PowerShell 5.1 or PowerShell 7.

Step by step

  1. Open the known vendor website yourself and verify product, version and Windows architecture. Avoid download buttons in advertisements. Record the official download address. A familiar filename alone does not establish origin.
  2. Save the file without running it. Open PowerShell as a normal user and replace the example path below with the actual full file path. Keep the single quotes; an apostrophe within the path must be doubled inside them.
  3. Read Status and SignerCertificate. Valid means signature verification succeeded on this system; still compare the certificate holder with the expected publisher. NotSigned indicates no verifiable Authenticode signature, neither automatic proof of malware nor permission to run.
  4. If the vendor publishes a SHA-256 value for this exact version and architecture, calculate the hash with the second command and compare the complete value. A locally calculated hash without a trusted reference says nothing about origin.
  5. Do not run the file if the hash differs, the publisher is unexpected or the signature is invalid. Recheck the download source and file or contact the vendor. Do not disable SmartScreen or antivirus to force the installer to run.

Read-only commands

Get-AuthenticodeSignature -LiteralPath 'C:\Downloads\setup.exe' | Format-List Status, StatusMessage, SignerCertificate
Get-FileHash -LiteralPath 'C:\Downloads\setup.exe' -Algorithm SHA256

Limits of verification

A valid signature does not establish that software is harmless or bug-free. A ZIP archive may be unsigned even though its installer is signed; check the file you will actually run. These read-only queries require neither administrator privileges nor an execution-policy change.

Sources