Why bother
Because the two ways a download goes wrong are both invisible: a copy hosted somewhere else that looks identical, and a real file altered on the way to you. Neither looks different in Explorer. Both fail the checks below.
Check 1 — the signature
Right-click → Properties. If there is a Digital Signatures tab, the name on the signature must be ours; somebody else's name means stop — that file is not the one we published.
A valid signature tells you who signed the file and that it has not changed since. It does not tell you which build you have, or that it is the one this page publishes a digest for — the fingerprint below does that, and it is the check that decides.
Check 2 — the fingerprint
Open PowerShell in the folder you downloaded to:
Get-FileHash .\w0a-*.exe -Algorithm SHA256Compare the result with the SHA-256 printed under the download button on our download page. It must match character for character.
A hash you copy from the same place you got the file is worth less than one you copy from a different place. We publish it on the site rather than beside the file for exactly that reason.
If either check fails
Delete the file. Download again from w0a.app — typed, not from a link somebody sent you.
If it fails a second time, or if you got the file from somewhere that is not our site, tell us where you got it.
What we do on our side
The download button on our site only ever points at our own domain or at our own GitHub release; the page will not offer a download from any other address.
Related
Did this page help?
What was missing, or what did not work? We read every one of these.
If this page did not solve it, write to us — say which article you read, and we will fix the article.