Verify a download

The installers aren’t code-signed. You can still check that the file you downloaded is exactly the one the release published, by comparing its SHA256 hash with the list that comes with every release.

Why it isn’t signed

Signing certificates cost money every year, and this is a free project. The SignPath Foundation signs open-source projects for free, but only once they’re widely known. The project applied on 19 October 2026 and was declined the next day for that reason, and will apply again once it’s better known.

When signing is on, the app and both installers will be signed before the hashes are written, so SHA256SUMS.txt will list the signed files.

Check the hash

From the release page, download the installer, x64 or ARM64, and SHA256SUMS.txt into the same folder.
Open PowerShell in that folder: open the folder in File Explorer, type powershell in the address bar and press Enter.

Run this for the x64 installer:

Get-FileHash .\NetworkSpeedMonitor-0.1.0-x64-setup.exe -Algorithm SHA256

Or this for the ARM64 installer:

Get-FileHash .\NetworkSpeedMonitor-0.1.0-arm64-setup.exe -Algorithm SHA256

Open SHA256SUMS.txt in Notepad. Find the line that ends with the installer’s name, and compare the long string at its start with the Hash that PowerShell printed. PowerShell prints capital letters and the file uses lower case; that isn’t a difference.

If every character matches, the file you have is byte for byte the one the release published: it wasn’t damaged or swapped on the way to you. If it doesn’t match, don’t run it. Download it again, and if it still doesn’t match, open an issue.

A match doesn’t prove the code is safe. It tells you the file is the one built and published by the release workflow, from source you can read. And since the installer and the hash list come from the same release page, it can’t catch someone who could change that page. A signature, once signing is on, doesn’t depend on the release page.

The SmartScreen warning

When you run an installer that isn’t signed and hasn’t been downloaded by many people yet, Windows may show a blue window titled “Windows protected your PC”. It means Microsoft Defender SmartScreen doesn’t recognise the app. It doesn’t mean it found anything harmful. Your browser may warn you when you download the file, for the same reason.

At first the window offers only Don’t run. To go ahead:

Check the hash first, as above. That’s the point: the warning is about a file Windows doesn’t know, and the hash tells you it’s the file the release published.
Select More info. The window then shows the file name and “Unknown publisher”.
Select Run anyway.

If you’d rather not run an unsigned installer, you can build the app yourself from the source; the README explains how.

Code signing policy

Releases are currently unsigned.

When signing is on, only the installers and the app built by this repository’s release workflow, from the tagged source, will be signed, and every signing request will be approved by hand.

Committers and reviewers: Ravi Bhushan
Approvers: Ravi Bhushan

Privacy: this program will not transfer any information to other networked systems unless specifically requested by the user or the person installing or operating it. It makes no network connections at all; see Privacy.