How to Check a Windows Installer’s Digital Signature Before You Run It

You have the installer on your desktop. How do you know it is the file the publisher actually shipped and not something a mirror site repackaged? Windows will tell you, and it takes about ten seconds to ask. This is the check we run on every executable before it touches a client machine, and it is the single fastest way to catch a tampered download before it does anything.

The tool is built into the operating system. No extra software, no upload to a scanning website. Here is what to look at and, more importantly, what the result actually means.

Two clicks to the answer

Right-click the file and open Properties. This works on .exe, .msi, .msix, and most other installer packages. On the properties window there is a tab labelled Digital Signatures. If the file is signed, it shows here. Click the signature in the list and then the Details button.

What you want to see is a line that reads “This digital signature is OK.” That is Windows confirming three separate things: the file has not been altered since it was signed, the signature was produced with a valid certificate, and the certificate chains back to a trusted authority. If all three hold, you get the OK.

If the tab is missing entirely, the file has no signature at all. That is your first red flag, and for a piece of commercial software it should stop you cold. There are genuine unsigned installers out there, usually small utilities from solo developers, but any established publisher signs its work. An unsigned setup file from a company you have heard of is not something to shrug at.

The name on the certificate matters more than the OK

Here is where people get lazy. They see “signature is OK” and stop reading. But a valid signature only proves the file comes from whoever owns that certificate. It does not prove the certificate belongs to the company you think you are downloading from.

So read the name. In the signature details, look at the signer. It should match the publisher of the software, not a random individual or an unrelated corporate entity. We have seen repackaged setup files signed by shell companies that exist only to make a bundle of adware look legitimate. The signature was technically valid. The file still filled the machine with junk.

This is the same problem the free-software reviewers keep flagging. Wizcase’s breakdown of free Windows tools notes that downloads more often than not carry a hidden cost, whether bloatware, data collection, or outright malware. A valid certificate does not clear a file of that. It just narrows the field of who is responsible.

A file with a valid signature can still fail to install

Signature and successful install are two different questions. A file can pass the signature check and still throw errors, because the signature says nothing about whether the setup will run on your system or whether the download finished cleanly.

If setup fails after you have confirmed the signature, the cause is somewhere else. Run the installer as administrator, since missing permissions are a common reason setup steps fail, as the Digitalicence install guide points out. Check free disk space. Confirm the OS version and, for heavier applications, the GPU meets the vendor’s requirements. A corrupt, partially downloaded file will often still show a valid signature on the part Windows can read, so if a setup that should work keeps failing, re-download it and compare the file size against the publisher’s own listing.

Checking without opening Properties

The graphical route is the one most people know. There is a faster command line method if you are checking several files at once. Open PowerShell and run Get-AuthenticodeSignature followed by the file path. It returns the signature status, the signer, and the certificate chain in text form. Handy when you are vetting a stack of installers in one go.

For the truly cautious, or for software bought through a reseller, there is one more layer. A reseller that sells verified downloads hands you a link and a license, but the file still needs checking. The Digitalicence guide is blunt about this: always use the official installer, never a third-party setup package. When you buy through a reseller, confirm the download originates from the vendor’s own servers rather than a file locker.

What to do when the signature is missing or bad

If Windows reports the signature is invalid, do not run it. That means the file was modified after signing, which is exactly the tampering you were checking for. Delete it and get a fresh copy from the publisher.

If it is signed but by the wrong party, treat it the same way. Do not assume the file is fine because it launched. A repackaged installer that installs the software you asked for and quietly adds a bundle you did not is not a win. A valid signature only binds the file to the certificate holder, so if that holder is not the publisher, the OK means nothing.

One practical wrinkle: some legitimate activation tools and older installers get flagged as suspicious by antivirus software even though they are genuine. The Digitalicence guide suggests temporarily disabling real-time protection during install if you trust the source, but only when the vendor explicitly says so and you have verified the signature first. Disabling protection for a file you have not checked is how machines get infected. Check the signature, then decide.

Why this check still belongs in your routine

Most people who install software regularly have learned to distrust the download page. The fake buttons, the bundled toolbars, the reworked installers with a dozen opt-outs. All of that is why the signature is worth the ten seconds. A single Properties check collapses the question from “is this the real file?” to “did the publisher sign it and is the signature intact?” That is a question you can answer without trusting the page you downloaded from.

It will not tell you whether the software is any good. It will not catch a legitimately signed installer from a company that bundles junk by design. But it closes the biggest hole: a file that someone else swapped in. For the cost, which is essentially zero, it is the first thing to do after any download and the last thing before running setup.