1. Source
Confirm that the release belongs to the mnstechbr/KPassword repository.
Verify download
Check the installer before opening it
Verification reduces the risk of installing the wrong file, a tampered file, or a file downloaded from the wrong source. It is a simple precaution, without promising absolute protection.
Start with the source
Latest public release
Always download from the official site or from the GitHub Releases page of the mnstechbr/KPassword repository.
2. Name
Check that the file looks like a KPassword installer, for example KPassword-Setup-v0.9.5.exe.
3. Hash
Use PowerShell to calculate the SHA256 of the downloaded file.
4. Doubt
If the name, hash, or source does not match, do not install it. Delete the file and download again from the official site or GitHub Releases.
SHA256
Check SHA256 in PowerShell
After downloading, open PowerShell in the file folder and run:
Get-FileHash .\KPassword-Setup-v1.3.0.exe -Algorithm SHA256Compare the displayed value with the SHA256 published in the official release, when available. If GitHub shows a SHA256 digest for the asset, it should match this result.
.sig + latest.json
Updater files
The .sig and latest.json files are used by the signed updater. They help the app validate updates, but they do not replace downloading from the correct source.
Avoid unknown sources
Do not install files received through messages, forums, short links, or third-party sites. If something looks different from the official release, stop and check first.