Verifying the Installer: SHA-256 and Digital Signatures

There are a lot of mirrors, and a fair number of repackaged builds. Thirty seconds of hashing beats an afternoon of malware cleanup.

Compute the SHA-256

Nothing to install - Windows ships two commands for this. In CMD:

certutil -hashfile "C:\Users\you\Downloads\Clash.for.Windows.Setup.exe" SHA256

In PowerShell:

Get-FileHash -Algorithm SHA256 "C:\Users\you\Downloads\Clash.for.Windows.Setup.exe"

You get 64 hex characters back. Case does not matter; only the characters do.

Whose value are you comparing against?

A hash only means something when you compare it with the value the publisher announced. If the same page serves both the download link and the checksum, that checksum protects you from almost nothing - whoever can swap the file can swap the line of text above it. What actually works:

• Copy the hash from the software's official download channel (the upstream release page or announcement), then fetch the file from a mirror and compare.
• Download the same version from two unrelated mirrors and compare them against each other. Matching copies make a single tampered mirror far less likely.
• If a download page publishes neither a hash nor a file size, use a different one.

Signatures and SmartScreen

Right-click the installer, choose Properties, and look for a Digital Signatures tab. If it is there, open it and check the signer plus the line confirming the signature is valid. If the tab is missing, the package simply is not signed - early CFW builds never were, so a missing tab is not by itself evidence of tampering. It does mean the hash is the only assurance you have.

The SmartScreen "Windows protected your PC" prompt fires because the file is rarely downloaded and carries no trusted signature. It says nothing about malware. Once the hash checks out, click More info, then Run anyway. Antivirus detections are a separate story - see Antivirus and Firewall Conflicts.