https://docs.hashwatch.us/reference/Recent content in Reference on HashWatch DocsHugoenhttps://docs.hashwatch.us/reference/covered-software/Mon, 01 Jan 0001 00:00:00 +0000https://docs.hashwatch.us/reference/covered-software/<h1 id="covered-software">Covered Software<a class="anchor" href="#covered-software">#</a></h1> <p>HashWatch tracks <strong>56 vendor fetchers</strong> covering Windows, Linux, macOS, and Android. All hashes are refreshed every day at <strong>02:00 UTC</strong>. Versions are always discovered dynamically — HashWatch never hardcodes a vendor version number.</p> <p>Each record&rsquo;s <strong>Source</strong> link on the dashboard points to the exact per-OS/arch file the hash was computed from.</p> <hr> <h2 id="security--endpoint-tools">Security &amp; Endpoint Tools<a class="anchor" href="#security--endpoint-tools">#</a></h2> <table> <thead> <tr> <th>Vendor</th> <th>Product</th> <th>Platforms</th> <th>How hashes are obtained</th> </tr> </thead> <tbody> <tr> <td>Microsoft</td> <td>PowerShell</td> <td>Windows (x64/x86/ARM64), Linux, macOS</td> <td>Official GitHub release assets with <code>.sha256</code> files</td> </tr> <tr> <td>Microsoft</td> <td>OpenSSH for Windows</td> <td>Windows</td> <td>Official GitHub release assets with <code>.sha256</code> files</td> </tr> <tr> <td>Git for Windows Project</td> <td>Git for Windows</td> <td>Windows (x64/x86/ARM64)</td> <td>GitHub release assets with <code>.sha256.txt</code> files</td> </tr> <tr> <td>Simon Tatham</td> <td>PuTTY, PLink, PSCP, PSFTP</td> <td>Windows</td> <td>Official <code>sha256sums</code> manifest file</td> </tr> <tr> <td>Microsoft (Sysinternals)</td> <td>PsExec, ProcMon, ProcExp, Autoruns, TCPView, Handle, Strings, ProcDump</td> <td>Windows</td> <td>Suite ZIP downloaded in memory; individual EXEs hashed†</td> </tr> <tr> <td>KeePassXC Team</td> <td>KeePassXC</td> <td>Windows, macOS, Linux</td> <td>GitHub release DIGESTS asset</td> </tr> <tr> <td>Bitwarden Inc.</td> <td>Bitwarden Desktop</td> <td>Windows, macOS, Linux</td> <td>GitHub release <code>.sha256</code> assets</td> </tr> <tr> <td>Bitwarden Inc.</td> <td>Bitwarden Android</td> <td>Android (Google Play + F-Droid)</td> <td>GitHub release sha256 text files (manifest; no download)</td> </tr> <tr> <td>Wireshark Foundation</td> <td>Wireshark</td> <td>Windows (x64/ARM64), macOS, Linux</td> <td>Wireshark CDN per-file <code>.sha256</code> files</td> </tr> <tr> <td>IDRIX</td> <td>VeraCrypt</td> <td>Windows (x64/x86/ARM64), macOS, Linux</td> <td>GitHub release <code>sha256sum.txt</code> sidecar</td> </tr> </tbody> </table> <h2 id="browsers">Browsers<a class="anchor" href="#browsers">#</a></h2> <table> <thead> <tr> <th>Vendor</th> <th>Product</th> <th>Platforms</th> <th>How hashes are obtained</th> </tr> </thead> <tbody> <tr> <td>Mozilla Foundation</td> <td>Firefox</td> <td>Windows (x64/x86), macOS, Linux</td> <td>Mozilla official <code>SHA256SUMS</code> manifest file</td> </tr> <tr> <td>Mozilla Foundation</td> <td>Firefox for Android (Fenix)</td> <td>Android (arm64, arm)</td> <td>GitHub release APK assets; downloaded and hashed in memory†</td> </tr> <tr> <td>Mozilla Foundation</td> <td>Thunderbird</td> <td>Windows (x64/x86), macOS, Linux</td> <td>Mozilla official <code>SHA256SUMS</code> manifest file</td> </tr> <tr> <td>Google LLC</td> <td>Chrome Enterprise</td> <td>Windows (x64/x86), macOS, Linux</td> <td>Binary downloaded, hashed in memory, discarded†</td> </tr> <tr> <td>Microsoft Corporation</td> <td>Microsoft Edge</td> <td>Windows (x64/ARM64), macOS, Linux</td> <td>Manifest — Microsoft enterprise update API</td> </tr> <tr> <td>Brave Software Inc.</td> <td>Brave Browser</td> <td>Windows (x64/x86/ARM64), macOS, Linux</td> <td>GitHub <code>.sha256</code> sidecars for all installer assets</td> </tr> <tr> <td>Brave Software Inc.</td> <td>Brave Android</td> <td>Android (arm64 universal, arm64 mono, arm, x64, x86; APK + AAB)</td> <td>GitHub <code>.sha256</code> sidecars for all APK/AAB assets</td> </tr> </tbody> </table> <h2 id="communication--messaging">Communication &amp; Messaging<a class="anchor" href="#communication--messaging">#</a></h2> <table> <thead> <tr> <th>Vendor</th> <th>Product</th> <th>Platforms</th> <th>How hashes are obtained</th> </tr> </thead> <tbody> <tr> <td>Signal Foundation</td> <td>Signal Desktop</td> <td>Windows (x64/ARM64), macOS, Linux</td> <td>Binary downloaded, hashed in memory, discarded† — YAML version file used</td> </tr> <tr> <td>Signal Foundation</td> <td>Signal Android</td> <td>Android (universal APK)</td> <td>Manifest — <code>updates.signal.org/android/latest.json</code> (no download)</td> </tr> <tr> <td>Zoom Video Communications</td> <td>Zoom</td> <td>Windows, macOS, Linux</td> <td>Binary downloaded, hashed in memory, discarded†</td> </tr> <tr> <td>Slack Technologies</td> <td>Slack</td> <td>Windows, macOS, Linux</td> <td>Binary downloaded, hashed in memory, discarded†</td> </tr> <tr> <td>Microsoft</td> <td>Microsoft Teams</td> <td>Windows (x64/ARM64), macOS</td> <td>Binary downloaded, hashed in memory, discarded†</td> </tr> <tr> <td>Telegram Messenger</td> <td>Telegram Desktop</td> <td>Windows (x64/ARM64), macOS, Linux</td> <td>GitHub release assets; downloaded and hashed†</td> </tr> <tr> <td>Telegram Messenger</td> <td>Telegram FOSS Android</td> <td>Android (universal APK)</td> <td>GitHub release APK; downloaded and hashed† (Telegram-FOSS-Team fork)</td> </tr> <tr> <td>Discord Inc.</td> <td>Discord</td> <td>Windows, macOS, Linux</td> <td>Always-latest CDN; downloaded and hashed†</td> </tr> <tr> <td>Meta Platforms Inc.</td> <td>WhatsApp</td> <td>Android (universal APK)</td> <td>Meta stable APK URL; downloaded and hashed†</td> </tr> </tbody> </table> <h2 id="runtimes--interpreters">Runtimes &amp; Interpreters<a class="anchor" href="#runtimes--interpreters">#</a></h2> <table> <thead> <tr> <th>Vendor</th> <th>Product</th> <th>Platforms</th> <th>How hashes are obtained</th> </tr> </thead> <tbody> <tr> <td>OpenJS Foundation</td> <td>Node.js v20 LTS, v22 LTS</td> <td>Windows, macOS, Linux</td> <td>Official <code>SHASUMS256.txt</code> manifest</td> </tr> <tr> <td>Google (Go)</td> <td>Go toolchain</td> <td>Windows, macOS, Linux</td> <td><code>go.dev/dl/?mode=json</code> manifest</td> </tr> <tr> <td>Python Software Foundation</td> <td>Python</td> <td>Windows, macOS, Linux</td> <td>Binary downloaded, hashed in memory, discarded†</td> </tr> <tr> <td>Eclipse Foundation (Adoptium)</td> <td>Temurin JDK 21 LTS, JDK 25</td> <td>Windows, macOS, Linux</td> <td>Adoptium REST API (SHA-256 in JSON response)</td> </tr> </tbody> </table> <h2 id="developer-tools">Developer Tools<a class="anchor" href="#developer-tools">#</a></h2> <table> <thead> <tr> <th>Vendor</th> <th>Product</th> <th>Platforms</th> <th>How hashes are obtained</th> </tr> </thead> <tbody> <tr> <td>Microsoft</td> <td>VS Code</td> <td>Windows, macOS, Linux (all architectures)</td> <td>VS Code Update API (returns SHA-256 directly)</td> </tr> <tr> <td>Notepad++ Project</td> <td>Notepad++</td> <td>Windows (x64/x86/ARM64)</td> <td>GitHub release assets with <code>.sha256</code> files</td> </tr> <tr> <td>Igor Pavlov</td> <td>7-Zip</td> <td>Windows (x64/x86), Linux (x64/ARM64)</td> <td>Binary downloaded, hashed in memory, discarded†</td> </tr> <tr> <td>GitHub Inc.</td> <td>GitHub CLI</td> <td>Windows, macOS, Linux</td> <td>GitHub release <code>checksums.txt</code> manifest</td> </tr> <tr> <td>FileZilla Project</td> <td>FileZilla</td> <td>Windows, macOS</td> <td>Binary downloaded, hashed in memory, discarded†</td> </tr> <tr> <td>Nmap Project</td> <td>Nmap</td> <td>Windows, macOS</td> <td>Binary downloaded, hashed in memory, discarded†</td> </tr> </tbody> </table> <h2 id="infrastructure--cloud-tools">Infrastructure &amp; Cloud Tools<a class="anchor" href="#infrastructure--cloud-tools">#</a></h2> <table> <thead> <tr> <th>Vendor</th> <th>Product</th> <th>Platforms</th> <th>How hashes are obtained</th> </tr> </thead> <tbody> <tr> <td>HashiCorp</td> <td>Terraform, Vault, Packer, Consul, Nomad, Vagrant, Boundary</td> <td>Windows, macOS, Linux</td> <td><code>releases.hashicorp.com</code> <code>SHA256SUMS</code> manifest</td> </tr> <tr> <td>Cloud Native Computing Foundation</td> <td>kubectl</td> <td>Windows, macOS, Linux</td> <td><code>dl.k8s.io</code> per-file <code>.sha256</code> files</td> </tr> <tr> <td>Amazon Web Services</td> <td>AWS CLI v2</td> <td>Windows, macOS, Linux</td> <td>Binary downloaded, hashed in memory, discarded†</td> </tr> </tbody> </table> <h2 id="remote-access--virtualisation">Remote Access &amp; Virtualisation<a class="anchor" href="#remote-access--virtualisation">#</a></h2> <table> <thead> <tr> <th>Vendor</th> <th>Product</th> <th>Platforms</th> <th>How hashes are obtained</th> </tr> </thead> <tbody> <tr> <td>AnyDesk Software GmbH</td> <td>AnyDesk</td> <td>Windows, macOS, Linux (amd64 + ARM64)</td> <td>Binary downloaded, hashed in memory, discarded† — version discovered dynamically</td> </tr> <tr> <td>TeamViewer</td> <td>TeamViewer Host &amp; Client</td> <td>Windows, Linux</td> <td>Binary downloaded, hashed in memory, discarded† — stable always-latest CDN URLs</td> </tr> <tr> <td>RustDesk</td> <td>RustDesk</td> <td>Windows, macOS, Linux</td> <td>GitHub release assets; downloaded and hashed†</td> </tr> <tr> <td>Oracle Corporation</td> <td>VirtualBox</td> <td>Windows, macOS, Linux</td> <td><code>download.virtualbox.org</code> <code>SHA256SUMS</code> manifest</td> </tr> </tbody> </table> <h2 id="productivity">Productivity<a class="anchor" href="#productivity">#</a></h2> <table> <thead> <tr> <th>Vendor</th> <th>Product</th> <th>Platforms</th> <th>How hashes are obtained</th> </tr> </thead> <tbody> <tr> <td>The Document Foundation</td> <td>LibreOffice</td> <td>Windows, macOS, Linux</td> <td>documentfoundation.org <code>.sha256</code> manifest files</td> </tr> <tr> <td>OBS Project</td> <td>OBS Studio</td> <td>Windows, macOS, Linux</td> <td>GitHub release assets; downloaded and hashed†</td> </tr> <tr> <td>VideoLAN Organisation</td> <td>VLC Media Player</td> <td>Windows (x64/x86), macOS</td> <td>VideoLAN update API + per-file sha256 manifest</td> </tr> </tbody> </table> <h2 id="android--authenticators-password-managers--communication">Android — Authenticators, Password Managers &amp; Communication<a class="anchor" href="#android--authenticators-password-managers--communication">#</a></h2> <table> <thead> <tr> <th>Vendor</th> <th>Product</th> <th>Platforms</th> <th>How hashes are obtained</th> </tr> </thead> <tbody> <tr> <td>Beem Development</td> <td>Aegis Authenticator (TOTP/HOTP)</td> <td>Android (universal APK)</td> <td>GitHub release APK; downloaded and hashed† (release build only)</td> </tr> <tr> <td>Kunzisoft</td> <td>KeePassDX</td> <td>Android (universal APK)</td> <td>GitHub release APK; downloaded and hashed†</td> </tr> <tr> <td>AgileBits Inc.</td> <td>1Password</td> <td>Windows</td> <td>Manifest — AgileBits product history JSON API</td> </tr> <tr> <td>WireGuard / Jason Donenfeld</td> <td>WireGuard</td> <td>Android (universal APK)</td> <td>GitHub APK; F-Droid manifest fallback</td> </tr> <tr> <td>Proton AG</td> <td>Proton Mail</td> <td>Android (universal APK)</td> <td>GitHub APK; F-Droid manifest fallback</td> </tr> </tbody> </table> <hr> <h2 id="-what-hashed-in-memory-discarded-means">† What &ldquo;hashed in memory, discarded&rdquo; means<a class="anchor" href="#-what-hashed-in-memory-discarded-means">#</a></h2> <p>For vendors that don&rsquo;t publish a separate hash file, HashWatch downloads the binary over HTTPS, streams it through the SHA-256/SHA-1/MD5 algorithms without writing the file content to disk, and then closes the connection. The binary content never touches the server filesystem.</p>