Why bother
Because the two ways a download goes wrong are both invisible: a copy hosted somewhere else that looks identical, and a real file altered on the way to you. Neither looks different in Explorer. Both fail the checks below.
A third way is less sinister and more common: a download that stopped part-way. The file is there, it has the right name, and it will not run. The fingerprint check catches that too.
Check 1 — the signature
Right-click the file → Properties.
- If there is a Digital Signatures tab, the name on the signature must be ours. Somebody else's name means stop — that file is not the one we published.
- If there is no such tab, the file is not signed, and this check tells you nothing either way. Check 2 is then the only check, and it is enough on its own.
A valid signature tells you who signed the file and that it has not changed since. It does not tell you which build you have, or that it is the one this site publishes a fingerprint for. The fingerprint below does that, and it is the check that decides.
Check 2 — the fingerprint
A SHA-256 fingerprint is a 64-character value calculated from every byte of the file. Change one byte and the whole value changes. Windows can calculate it without installing anything.
Open PowerShell in the folder you downloaded to (in Explorer, type powershell in the address bar and press Enter):
Get-FileHash .\w0a-*.exe -Algorithm SHA256If there is more than one w0a file in the folder, it prints a line for each. Use the one you are about to run.
The same thing from Command Prompt:
for %f in (w0a-*.exe) do certutil -hashfile "%f" SHA256Compare the result with the SHA-256 printed under the download button on our download page. It must match character for character. Upper or lower case does not matter; every other difference does.
A fingerprint copied from the same place you got the file is worth less than one copied from a different place. Whoever can change the file there can change the fingerprint beside it. We publish it on the site rather than beside the file for exactly that reason.
If either check fails
Delete the file. Do not run it "to see". Download again from w0a.app, typed into the address bar, not from a link somebody sent you.
If the fingerprint is wrong again, first check you are comparing the right file. A browser may have saved the second download with (1) at the end of its name and left the old one in place.
If it still fails, or if you got the file from anywhere that is not our site, tell us where you got it. A copy of w0a on another site is something we want to know about.
What we do on our side
The download button on our site is switched off unless two things are true:
- the address points at our own domain, or at the release page of our own public GitHub repository, and no other;
- a well-formed SHA-256 fingerprint is published beside it.
So the page cannot offer a download from a stranger's address, and it cannot offer one without a fingerprint to check it against.
Related
What a game booster or optimizer can change in Windows, what it cannot, and how to check one before you trust it: Do game boosters and optimizers actually work?
Did this page help?
What was missing, or what did not work? We read every one of these.
If this page did not solve it, write to us — say which article you read, and we will fix the article.