Skip to content

Is the download safe?

When you download PastPaths, Windows, your browser or your antivirus program may warn you. This guide shows why that happens and how you can check for yourself that the file is genuine before you install it. It takes a couple of minutes.

1. Download from the right place

  • Use the Download page on pastpaths.se or PastPaths' page on GitHub. Both fetch the same file from GitHub.
  • The installer is called PastPaths-Setup- followed by the version, for example PastPaths-Setup-1.11.0.exe.
  • Did someone else send you the file, for example by email or on a forum? Download it yourself instead. Then you know it hasn't been changed along the way.

2. Why Windows warns you

Windows SmartScreen judges programs by reputation. A program that is new, or that few people have downloaded, gets a warning unless it is code-signed. Code signing is a purchased certificate that shows who made the program. PastPaths doesn't have such a certificate yet. The warning means Windows doesn't recognise the program, not that anything is wrong.

  1. Click More info in the Windows protected your PC box.
  2. Check that the file name next to App starts with PastPaths-Setup. Next to Publisher it says Unknown publisher – that's expected for a program without code signing.
  3. Click Run anyway.

Your browser may warn you too

Edge and Chrome sometimes warn about files that aren't downloaded very often. Click the three dots next to the file in the download list and choose Keep. The warning usually goes away once more people have downloaded the version.

3. Check the file on VirusTotal

VirusTotal is a free service where around seventy antivirus programs examine the same file. You don't need to upload the file. It's enough to search for its checksum, which you'll find in the next section.

  1. Copy the checksum from GitHub or calculate it yourself.
  2. Go to virustotal.com, choose Search and paste the checksum.
  3. Look at the ring at the top of the page.
It says It means
0 / 71 in green None of the programs found anything.
One or two hits Typical of a false positive, usually from programs that judge files with machine learning.
Many hits Don't install. Get in touch with me.

Words that sound worse than they are

Further down the page, under Behavior, you'll sometimes see words like obfuscated, crypto or Process Injection. These are automatic descriptions of how the program behaves in a test environment. PastPaths is built with PyInstaller, which packs the program into a single file, and Python has encryption libraries built in. Labels like these show up for almost every program of that kind. If you see Microsoft addresses under Relations, that's Windows in the test environment checking in, not PastPaths. The number in the ring is what counts.

4. Check that the file hasn't been changed

A checksum (SHA-256) is the file's fingerprint: a long string of letters and digits. If a single character in the file changes, the checksum becomes completely different. If the checksum for your file matches the one on GitHub, it is exactly the same file I uploaded.

The checksum on GitHub. Open PastPaths releases on GitHub. Next to the installer under Assets you'll find the checksum. It starts with sha256:.

Your own checksum.

  1. Right-click Start and choose Terminal or Windows PowerShell.
  2. Type Get-FileHash and a space.
  3. Drag the installer from File Explorer into the window. The path is typed in for you.
  4. Press Enter.

The line looks roughly like this:

Get-FileHash "C:\Users\Anna\Downloads\PastPaths-Setup-1.11.0.exe"

The checksum is shown under Hash. Windows writes it in capital letters and GitHub in lower case. That doesn't matter.

Compare quickly

Select the checksum in the window and copy it with Ctrl+C. Go to the GitHub page, press Ctrl+F and paste. If the checksum is highlighted next to the installer, it's the same file. You can then paste the same checksum into VirusTotal.

5. If your antivirus program stops the file

  • Check the file first using the sections above.
  • Allow the file or add an exception in your antivirus program, and install again. How you do it differs between programs. Search for the program's name and "exception".
  • Report the false positive to the vendor. Most antivirus companies have a form for it. A report helps everyone who downloads after you.
  • Let me know which program it is. → Report

6. What PastPaths does on your computer

  • Everything you enter is stored locally on your computer. There's no account and no cloud service.
  • PastPaths doesn't send any statistics or telemetry, and it doesn't check for new versions on its own.
  • The program only goes online when you yourself use one of these features:
    • The map, and the small map on a place's page, fetch map images from OpenStreetMap.
    • The Place Library fetches the list of packs, and the packs you import, from pastpaths.se.
    • The WordPress import fetches the images from your WordPress site. The export file itself is read from your computer, just like a GEDCOM file.
  • No data from your database is sent in any of these cases.

→ Privacy Policy

See also