Verify your download

What HatchZip does and does not do

• It reads the archive you give it and writes the extracted files next to it. It works only with files on your computer.
• It does not use the network. It has no networking code and no networking library. Every change to the code is checked in CI against a list of HTTP, TLS and socket libraries, and the check fails if one of them enters the dependencies (deny.toml). The desktop app's two links, to the source code in the About window and to the latest release under Help, Check for updates, open in your web browser when you click them.
• The programs themselves are checked too. Before a release is published, the release workflow checks that the Windows and macOS programs import no networking library and no socket function, and that no Windows networking library is named anywhere in them, so none can be loaded later (no-network.py). In 0.1.8, hatchzip.exe imports 6 Windows system libraries and the desktop app 20, for files, windows, drawing, fonts, text input, accessibility and the registry.
• It has no telemetry and no accounts, and it never checks for updates itself. It collects nothing and sends nothing.
• The Windows setup installs for the current user only, without administrator rights. It adds HatchZip to the right-click menu and to "Open with" for archive files, and puts the hatchzip command on your PATH. The uninstaller removes all of it.
• All of the source is public under the MIT or Apache-2.0 license. The downloads decode RAR archives with UnRAR, whose source is public under its own license.

Antivirus warnings

The release files are not code-signed yet. Windows SmartScreen shows "Windows protected your PC" for a new program without a signature, and macOS asks you to allow the app in System Settings. A few antivirus engines also flag new, unsigned programs, mostly the ones that score files with machine learning or behaviour rules rather than by matching known malware.

The behaviours that sandboxes report for the Windows setup are what any installer does: it writes program files, adds the right-click menu and "Open with" entries to the registry, and runs the helper process of Inno Setup, the installer it is built with.

For the desktop app, some sandboxes also list abilities such as "takes screenshots", "reads the keyboard" or "uses the clipboard". These labels come from Windows functions that every app drawing its own window imports: BitBlt and GetDC put each frame of the window on screen, GetKeyState and raw input read the keys typed into the app while its window is in front, and the clipboard functions serve copy and paste in its text fields. With no networking library and no socket function, the app has no way to send anything anywhere, by email or otherwise.

Code signing is planned. Until then, the checks below show whether a file is genuine. Each file in the table links to its current VirusTotal report.

Check a download

1. Compare the SHA-256 checksum

Every release file has a .sha256 file next to it on the releases page, and its checksum is also in the table below. If the checksum of your file matches, it is byte for byte the published file. Download both into the same folder, then run the command for your system there.

Windows, in PowerShell:

Get-FileHash .\HatchZip-x64-setup.exe -Algorithm SHA256

Compare the Hash it prints with the one in the .sha256 file or the table; PowerShell prints it in capitals, which makes no difference. Or let PowerShell compare them, which prints True when they match:

(Get-FileHash .\HatchZip-x64-setup.exe).Hash -eq (Get-Content .\HatchZip-x64-setup.exe.sha256).Split(' ')[0]

Linux:

sha256sum -c hatchzip-x86_64-linux.tar.gz.sha256

macOS:

shasum -a 256 -c HatchZip-aarch64.dmg.sha256

Both print the file name followed by OK when it matches. The install scripts (install.sh and install.ps1) run this check themselves before installing.

2. Verify the signed build provenance

A checksum shows that the file was not changed after it was published. Build provenance also shows where it came from: every release file from 0.1.3 on carries a signed attestation that it was built by the release workflow in github.com/xevrion/hatchzip, from the commit of that release tag. With the GitHub CLI installed and signed in:

gh attestation verify HatchZip-x64-setup.exe --repo xevrion/hatchzip

It exits with success when the file matches an attestation from that repository, and fails with an error for any file that was changed or built anywhere else. Use the name of the file you downloaded. To also check that it was built by the release workflow from the tag of its version, add the workflow and the tag:

gh attestation verify HatchZip-x64-setup.exe --repo xevrion/hatchzip --signer-workflow xevrion/hatchzip/.github/workflows/release.yml --source-ref refs/tags/v0.1.8

3. Build it from source

With Rust installed, this downloads the source of the command-line tool from crates.io and builds it on your machine:

cargo install hatchzip

That build reads every format except RAR. cargo install hatchzip --features rar adds RAR support and needs a C++ compiler. To build the desktop app too, clone the repository and run cargo build --release, as described in the README.

Release files

HatchZip 0.1.8, published 28 October 2026.

VirusTotal results change over time as engines update their rules, so this page links to the current report instead of quoting it. If VirusTotal has no report for a file yet, you can upload the file there yourself.

Report a problem

If a file does not match its checksum or its attestation, do not run it, and open an issue saying where you downloaded it. Report security vulnerabilities in HatchZip privately, as the security policy describes.