Covered Software#
HashWatch tracks 56 vendor fetchers covering Windows, Linux, macOS, and Android. All hashes are refreshed every day at 02:00 UTC. Versions are always discovered dynamically — HashWatch never hardcodes a vendor version number.
Each record’s Source link on the dashboard points to the exact per-OS/arch file the hash was computed from.
| Vendor | Product | Platforms | How hashes are obtained |
|---|
| Microsoft | PowerShell | Windows (x64/x86/ARM64), Linux, macOS | Official GitHub release assets with .sha256 files |
| Microsoft | OpenSSH for Windows | Windows | Official GitHub release assets with .sha256 files |
| Git for Windows Project | Git for Windows | Windows (x64/x86/ARM64) | GitHub release assets with .sha256.txt files |
| Simon Tatham | PuTTY, PLink, PSCP, PSFTP | Windows | Official sha256sums manifest file |
| Microsoft (Sysinternals) | PsExec, ProcMon, ProcExp, Autoruns, TCPView, Handle, Strings, ProcDump | Windows | Suite ZIP downloaded in memory; individual EXEs hashed† |
| KeePassXC Team | KeePassXC | Windows, macOS, Linux | GitHub release DIGESTS asset |
| Bitwarden Inc. | Bitwarden Desktop | Windows, macOS, Linux | GitHub release .sha256 assets |
| Bitwarden Inc. | Bitwarden Android | Android (Google Play + F-Droid) | GitHub release sha256 text files (manifest; no download) |
| Wireshark Foundation | Wireshark | Windows (x64/ARM64), macOS, Linux | Wireshark CDN per-file .sha256 files |
| IDRIX | VeraCrypt | Windows (x64/x86/ARM64), macOS, Linux | GitHub release sha256sum.txt sidecar |
Browsers#
| Vendor | Product | Platforms | How hashes are obtained |
|---|
| Mozilla Foundation | Firefox | Windows (x64/x86), macOS, Linux | Mozilla official SHA256SUMS manifest file |
| Mozilla Foundation | Firefox for Android (Fenix) | Android (arm64, arm) | GitHub release APK assets; downloaded and hashed in memory† |
| Mozilla Foundation | Thunderbird | Windows (x64/x86), macOS, Linux | Mozilla official SHA256SUMS manifest file |
| Google LLC | Chrome Enterprise | Windows (x64/x86), macOS, Linux | Binary downloaded, hashed in memory, discarded† |
| Microsoft Corporation | Microsoft Edge | Windows (x64/ARM64), macOS, Linux | Manifest — Microsoft enterprise update API |
| Brave Software Inc. | Brave Browser | Windows (x64/x86/ARM64), macOS, Linux | GitHub .sha256 sidecars for all installer assets |
| Brave Software Inc. | Brave Android | Android (arm64 universal, arm64 mono, arm, x64, x86; APK + AAB) | GitHub .sha256 sidecars for all APK/AAB assets |
Communication & Messaging#
| Vendor | Product | Platforms | How hashes are obtained |
|---|
| Signal Foundation | Signal Desktop | Windows (x64/ARM64), macOS, Linux | Binary downloaded, hashed in memory, discarded† — YAML version file used |
| Signal Foundation | Signal Android | Android (universal APK) | Manifest — updates.signal.org/android/latest.json (no download) |
| Zoom Video Communications | Zoom | Windows, macOS, Linux | Binary downloaded, hashed in memory, discarded† |
| Slack Technologies | Slack | Windows, macOS, Linux | Binary downloaded, hashed in memory, discarded† |
| Microsoft | Microsoft Teams | Windows (x64/ARM64), macOS | Binary downloaded, hashed in memory, discarded† |
| Telegram Messenger | Telegram Desktop | Windows (x64/ARM64), macOS, Linux | GitHub release assets; downloaded and hashed† |
| Telegram Messenger | Telegram FOSS Android | Android (universal APK) | GitHub release APK; downloaded and hashed† (Telegram-FOSS-Team fork) |
| Discord Inc. | Discord | Windows, macOS, Linux | Always-latest CDN; downloaded and hashed† |
| Meta Platforms Inc. | WhatsApp | Android (universal APK) | Meta stable APK URL; downloaded and hashed† |
Runtimes & Interpreters#
| Vendor | Product | Platforms | How hashes are obtained |
|---|
| OpenJS Foundation | Node.js v20 LTS, v22 LTS | Windows, macOS, Linux | Official SHASUMS256.txt manifest |
| Google (Go) | Go toolchain | Windows, macOS, Linux | go.dev/dl/?mode=json manifest |
| Python Software Foundation | Python | Windows, macOS, Linux | Binary downloaded, hashed in memory, discarded† |
| Eclipse Foundation (Adoptium) | Temurin JDK 21 LTS, JDK 25 | Windows, macOS, Linux | Adoptium REST API (SHA-256 in JSON response) |
| Vendor | Product | Platforms | How hashes are obtained |
|---|
| Microsoft | VS Code | Windows, macOS, Linux (all architectures) | VS Code Update API (returns SHA-256 directly) |
| Notepad++ Project | Notepad++ | Windows (x64/x86/ARM64) | GitHub release assets with .sha256 files |
| Igor Pavlov | 7-Zip | Windows (x64/x86), Linux (x64/ARM64) | Binary downloaded, hashed in memory, discarded† |
| GitHub Inc. | GitHub CLI | Windows, macOS, Linux | GitHub release checksums.txt manifest |
| FileZilla Project | FileZilla | Windows, macOS | Binary downloaded, hashed in memory, discarded† |
| Nmap Project | Nmap | Windows, macOS | Binary downloaded, hashed in memory, discarded† |
| Vendor | Product | Platforms | How hashes are obtained |
|---|
| HashiCorp | Terraform, Vault, Packer, Consul, Nomad, Vagrant, Boundary | Windows, macOS, Linux | releases.hashicorp.com SHA256SUMS manifest |
| Cloud Native Computing Foundation | kubectl | Windows, macOS, Linux | dl.k8s.io per-file .sha256 files |
| Amazon Web Services | AWS CLI v2 | Windows, macOS, Linux | Binary downloaded, hashed in memory, discarded† |
Remote Access & Virtualisation#
| Vendor | Product | Platforms | How hashes are obtained |
|---|
| AnyDesk Software GmbH | AnyDesk | Windows, macOS, Linux (amd64 + ARM64) | Binary downloaded, hashed in memory, discarded† — version discovered dynamically |
| TeamViewer | TeamViewer Host & Client | Windows, Linux | Binary downloaded, hashed in memory, discarded† — stable always-latest CDN URLs |
| RustDesk | RustDesk | Windows, macOS, Linux | GitHub release assets; downloaded and hashed† |
| Oracle Corporation | VirtualBox | Windows, macOS, Linux | download.virtualbox.org SHA256SUMS manifest |
Productivity#
| Vendor | Product | Platforms | How hashes are obtained |
|---|
| The Document Foundation | LibreOffice | Windows, macOS, Linux | documentfoundation.org .sha256 manifest files |
| OBS Project | OBS Studio | Windows, macOS, Linux | GitHub release assets; downloaded and hashed† |
| VideoLAN Organisation | VLC Media Player | Windows (x64/x86), macOS | VideoLAN update API + per-file sha256 manifest |
Android — Authenticators, Password Managers & Communication#
| Vendor | Product | Platforms | How hashes are obtained |
|---|
| Beem Development | Aegis Authenticator (TOTP/HOTP) | Android (universal APK) | GitHub release APK; downloaded and hashed† (release build only) |
| Kunzisoft | KeePassDX | Android (universal APK) | GitHub release APK; downloaded and hashed† |
| AgileBits Inc. | 1Password | Windows | Manifest — AgileBits product history JSON API |
| WireGuard / Jason Donenfeld | WireGuard | Android (universal APK) | GitHub APK; F-Droid manifest fallback |
| Proton AG | Proton Mail | Android (universal APK) | GitHub APK; F-Droid manifest fallback |
† What “hashed in memory, discarded” means#
For vendors that don’t publish a separate hash file, HashWatch downloads the binary over HTTPS, streams it through the SHA-256/SHA-1/MD5 algorithms without writing the file content to disk, and then closes the connection. The binary content never touches the server filesystem.
Each download operation is permanently logged with a storage_method: stream and disk_write: false flag as machine-readable evidence.
Requesting additional software coverage#
Coverage additions are made by the HashWatch development team. To request additional software coverage, open an issue on the project repository with:
- The vendor name and product name
- The operating systems / architectures to cover
- Whether the vendor publishes an official hash manifest (SHA256SUMS,
.sha256 files, or a JSON API)