Verify your download

What HatchZip does and does not do

• It reads the archive you give it and writes the extracted files next to it. It works only with files on your computer.
• It does not use the network. It has no networking code and no networking library. Every change to the code is checked in CI against a list of HTTP, TLS and socket libraries, and the check fails if one of them enters the dependencies (deny.toml). The one link in the desktop app, to the source code in the About window, opens in your web browser when you click it.
• It has no telemetry, no accounts and no update checks. It collects nothing and sends nothing.
• The Windows setup installs for the current user only, without administrator rights. It adds HatchZip to the right-click menu and to "Open with" for archive files, and puts the hatchzip command on your PATH. The uninstaller removes all of it.
• All of the source is public under the MIT or Apache-2.0 license. The downloads decode RAR archives with UnRAR, whose source is public under its own license.

Antivirus warnings

The release files are not code-signed yet. Windows SmartScreen shows "Windows protected your PC" for a new program without a signature, and macOS asks you to allow the app in System Settings. A few antivirus engines also flag new, unsigned programs, mostly the ones that score files with machine learning or behaviour rules rather than by matching known malware.

The behaviours that sandboxes report for the Windows setup are what any installer does: it writes program files, adds the right-click menu and "Open with" entries to the registry, and runs the helper process of Inno Setup, the installer it is built with.

Code signing is planned. Until then, the checks below show whether a file is genuine. Each file in the table links to its current VirusTotal report.

Check a download

1. Compare the SHA-256 checksum

Every release file has a .sha256 file next to it on the releases page, and its checksum is also in the table below. If the checksum of your file matches, it is byte for byte the published file. Download both into the same folder, then run the command for your system there.

Windows, in PowerShell:

Get-FileHash .\HatchZip-x64-setup.exe -Algorithm SHA256

Compare the Hash it prints with the one in the .sha256 file or the table; PowerShell prints it in capitals, which makes no difference. Or let PowerShell compare them, which prints True when they match:

(Get-FileHash .\HatchZip-x64-setup.exe).Hash -eq (Get-Content .\HatchZip-x64-setup.exe.sha256).Split(' ')[0]

Linux:

sha256sum -c hatchzip-x86_64-linux.tar.gz.sha256

macOS:

shasum -a 256 -c HatchZip-aarch64.dmg.sha256

Both print the file name followed by OK when it matches. The install scripts (install.sh and install.ps1) run this check themselves before installing.

2. Verify the signed build provenance

A checksum shows that the file was not changed after it was published. Build provenance also shows where it came from: every release file from 0.1.3 on carries a signed attestation that it was built by the release workflow in github.com/xevrion/hatchzip, from the commit of that release tag. With the GitHub CLI installed and signed in:

gh attestation verify HatchZip-x64-setup.exe --repo xevrion/hatchzip

It exits with success when the file matches an attestation from that repository, and fails with an error for any file that was changed or built anywhere else. Use the name of the file you downloaded.

3. Build it from source

With Rust installed, this downloads the source of the command-line tool from crates.io and builds it on your machine:

cargo install hatchzip

That build reads every format except RAR. cargo install hatchzip --features rar adds RAR support and needs a C++ compiler. To build the desktop app too, clone the repository and run cargo build --release, as described in the README.

Release files

HatchZip 0.1.3, published 24 October 2026.

VirusTotal results change over time as engines update their rules, so this page links to the current report instead of quoting it. If VirusTotal has no report for a file yet, you can upload the file there yourself.

Report a problem

If a file does not match its checksum or its attestation, do not run it, and open an issue saying where you downloaded it. Report security vulnerabilities in HatchZip privately, as the security policy describes.