Why bother
Because the two ways a download goes wrong are both invisible: a copy hosted somewhere else that looks identical, and a real file altered on the way to you. Neither looks different in Explorer. Both fail the checks below.
Check 1 — the publisher
w0a is code-signed, so right-click → Properties has a Digital Signatures tab and the signature in it is ours. If the tab is missing, or the name on the signature is somebody else's, stop — that file is not the one we published.
A valid signature tells you the file is ours and that nobody has altered it since we signed it. It does not tell you which build you have, or that it is the one this page publishes a digest for — the fingerprint below does that. Do both.
Check 2 — the fingerprint
Open PowerShell in the folder you downloaded to:
Get-FileHash .\w0a.exe -Algorithm SHA256Compare the result with the SHA-256 printed under the download button on our home page. It must match character for character.
A hash you copy from the same place you got the file is worth less than one you copy from a different place. We publish it on the site rather than beside the file for exactly that reason.
If either check fails
Delete the file. Download again from w0a.app — typed, not from a link somebody sent you.
If it fails a second time, or if you got the file from somewhere that is not our site, tell us where you got it. We watch the download link continuously and a report from you is a second pair of eyes on it.
What we do on our side
The download link and the file behind it are checked around the clock from several networks, and the file's hash is recomputed and compared against the published one. If the bytes behind the link ever change without us publishing a new version, the download is taken offline automatically rather than after somebody notices.
Related
Did this page help?
What was missing, or what did not work? We read every one of these.
If this page did not solve it, write to us — say which article you read, and we will fix the article.