How to check a downloaded app's digital signature in Windows

Before you install a downloaded Windows app, check where its installer came from and who signed it. In File Explorer, right-click the downloaded .exe, open Properties → Digital Signatures, select a signature and choose Details. Check that Windows reports This digital signature is OK, then compare the signer’s name with the software publisher’s official information.

If the signature is absent, invalid or from an unexpected signer, leave the file closed while you investigate. A signature helps check the signer and signed contents; it does not certify that an app is harmless.

Start with the download source

Get the installer from the developer’s official website or a verified store. Check that the page identifies the same product and version as the file you downloaded. A signature cannot tell you whether a download link came from a fake page, and a familiar filename or icon does not identify its publisher.

These steps focus on downloaded Windows .exe installers. Windows Explorer’s Digital Signatures tab displays certificates for signed binaries, as described in Microsoft’s Authenticode documentation .

Check the signature in File Explorer

1. In File Explorer, find the installer you downloaded. Right-click that exact file and select Properties.
2. Open the Digital Signatures tab. If there is more than one entry, select the signature you want to inspect.
3. Select Details. Read the verification message. If Windows says This digital signature is OK, note the Name of signer.
4. Compare that name with the publisher information on the official product or download page. A certificate can show a company’s legal name instead of the product’s brand; confirm the relationship through the publisher’s own site.

If the Digital Signatures tab is missing, Windows Explorer did not find a signature it can display for that file. Do not treat the file as signed on the strength of its name or download page alone. You can also inspect it with PowerShell, which can report Authenticode signature information for a file or a Windows catalog signature.

Inspect the file with PowerShell

Windows PowerShell can show the signature status and signer certificate without starting the installer. Open PowerShell, enter the full path to the downloaded file when prompted, and run:

$download = Read-Host 'Full path to the downloaded EXE'
$signature = Get-AuthenticodeSignature -LiteralPath $download

$signature | Format-List Status, StatusMessage, Path
$signature.SignerCertificate | Format-List Subject, Issuer, Thumbprint

Microsoft’s Get-AuthenticodeSignature reference documents the -LiteralPath parameter and notes that the cmdlet runs on Windows. If the file is unsigned, its signature fields are blank.

Read Status and the signer certificate together:

• Valid means the signature is syntactically valid. Microsoft’s SignatureStatus reference explicitly says this status does not imply trust. Check the signer’s Subject and use the File Explorer Details result to review Windows’ signature verification.
• NotSigned means no signature was found. That is not proof of malware, but it leaves you without this publisher-identity check. Look for another verification method from the official publisher, such as a published SHA-256 checksum.
• HashMismatch means the signed content does not match the signature. Do not run the file. Obtain a fresh copy from the official source; if the mismatch repeats, contact the publisher or your IT administrator.
• NotTrusted means this Windows installation does not trust the signing certificate. Do not install a certificate from an unrelated download or forum to make the warning disappear. For a work or school app, ask IT; for a public download, ask the publisher to confirm the signer.
• UnknownError, NotSupportedFileFormat or Incompatible means the check did not establish a valid result. Treat it as unresolved, not as a pass.

A signature and a checksum answer different questions

An Authenticode signature links a signer certificate to the signed content. A SHA-256 checksum is a separate value published by the software developer; calculating the downloaded file’s hash and comparing it with the developer’s value checks that exact file against that reference.

For Windows executable files, Authenticode does not use a flat hash of every byte: Microsoft’s executable-signing explanation describes how some file fields are excluded from the signature calculation. If the publisher provides a SHA-256 value for the exact version and file you downloaded, you can check both the signature and the checksum. Neither check proves what the software will do when you run it.

Why SmartScreen can still warn

Microsoft Defender SmartScreen evaluates both publisher reputation and file-hash reputation. The SmartScreen reputation guidance explains that a newly created, signed app can still show an unrecognised app warning while its reputation is unknown. That warning does not, by itself, prove the file is malicious; a signature that looks valid does not make the warning irrelevant either.

Check the exact warning, the download source and the signer. If Windows identifies the file as known unsafe, the source is unexpected, or the signer does not match the publisher, do not run it or disable SmartScreen to get past the message. If an unrecognised-app warning remains after the official source and signer check out, the signature check has answered only who signed the file and whether Windows accepts its signed content—not whether the app is safe for you.

When the source, signer and verification result do not line up, leave the installer closed and ask the software publisher or your device administrator.