Where to download desktop software, in order of trust
The same program can be fetched from four or five places. Here is how they differ, and which to try first.
Search for almost any desktop program and the results page offers several places to get it: the maker's website, an operating-system store, a command-line installer, and a row of download portals. The file may be identical in each case, or it may not. Choosing the source is the first security decision you make about a program, and it happens before a single byte reaches your disk.
1. The built-in store or package manager
Modern operating systems ship with a curated source of software. On phones and many desktops this is an app store, a distribution platform through which the platform owner offers applications. On Linux, and increasingly on Windows and macOS, it is a package manager: a tool that automates installing, upgrading and removing programs from a known repository. Both remove the need to find a download page at all, and both handle updates. Their weakness is coverage: plenty of good software is not listed, and a listing is not a guarantee of quality.
2. The developer's own website
When the store does not carry a program, go to the people who make it. The difficulty is being sure you have found them. Reach the site through a link you have reason to trust, such as the project's source-code repository or its encyclopedia entry, and do not rely on the first search result, which may be a paid placement. Once you are confident of the address, bookmark it.
3. The project's code hosting page
A great deal of open-source software publishes releases straight from the place where the code is developed. These pages usually list every version, a change history and file hashes. For open-source tools this is often the most direct source of all.
4. Download portals
Portals collect installers for thousands of programs. Some are careful mirrors. Others repackage installers with additional offers, surround the real link with advertising, or host versions long out of date. A portal adds a middleman between you and the developer, so use one only when the first three options are unavailable, and check the file afterwards (see checksums and code signing).
5. Links in adverts, emails and messages
Treat these as the least reliable route. Criminals buy advertising space to push fake installers, a practice called malvertising, and send messages urging a quick "update". If a message tells you to install or update something, close it and visit the source yourself using options one to three.
Whichever source you choose
- Read the address bar before clicking download. A padlock shows the connection is encrypted; it says nothing about who owns the site.
- Prefer the standard installer over "download managers" or "installer helpers".
- Note the version number, so you can tell later whether you are up to date.
- Keep the downloaded file until you have verified it.
No source is risk-free. Curated stores have carried bad apps, and genuine developer sites have been compromised. The order above lowers the odds; it does not replace verification, backups and up-to-date security software.
written by Bram Oosterveld / last revised 2026-11-12