How to verify Top Video Downloader and get past SmartScreen

Updated October 7, 2026 · tested with version 2.0.0

Windows SmartScreen and macOS Gatekeeper warn about Top Video Downloader because its installers are not code-signed yet, not because a threat was found. You can confirm the file is the one we published by comparing its SHA-256 checksum with SHA256SUMS on the GitHub release. In-app updates are checked automatically with an Ed25519 signature.

Installer code signing

Not yet, on Windows or macOS

Checksums

SHA-256 for every installer: SHA256SUMS on each GitHub release, and next to each download button on the site

App updates

Ed25519-signed manifest, checked before installing

yt-dlp updates

Ed25519-signed; a bad signature is rejected

Official sources

top-video-downloader.com and GitHub Releases

Why does Windows or macOS warn about the installer?

Code signing means buying a certificate tied to a verified publisher identity; on macOS it also means Apple notarization. Top Video Downloader's installers are not code-signed right now, and every GitHub release note says so. That's why Windows shows “Unknown publisher” and macOS says it can't verify the developer.

The warning means “Windows doesn't know who made this file”, not “this file contains malware”. But Windows can't tell our installer from a fake with the same name either, so spend a minute checking the SHA-256 before you run it.

How to run the installer when SmartScreen blocks it (Windows 10/11)

1. 1

   Download the .exe from our site or the GitHub release page. If your browser says the file isn't commonly downloaded, choose Keep.

2. 2

   Check the SHA-256 before running it (see below). If it doesn't match, stop here.

3. 3

   Run the installer. A blue “Windows protected your PC” window appears. Click More info.

4. 4

   The publisher shows as “Unknown publisher”. Click Run anyway.

5. 5

   The installer opens in English or Russian, depending on your Windows language.

How to open the app on a Mac when Gatekeeper blocks it

The macOS build is for Apple Silicon only (M1 and newer). There is no Intel Mac build.

1. 1

   Open the .dmg and drag the app into Applications.

2. 2

   Launch it once. macOS refuses and says it can't verify the app. Click Done, not “Move to Trash”.

3. 3

   On macOS 15 Sequoia and later: open System Settings → Privacy & Security, scroll to the Security section and click Open Anyway next to the app. Confirm with your password or Touch ID.

4. 4

   On macOS 14 and earlier: in Applications, Control-click (or right-click) the app → Open, then click Open again in the dialog.

5. 5

   You only do this once. After that the app opens normally.

How to start the AppImage on Linux

1. 1

   Make it executable: chmod +x top-video-downloader_2.0.0_amd64.AppImage (or Properties → “Allow executing” in your file manager).

2. 2

   Run it: ./top-video-downloader_2.0.0_amd64.AppImage.

3. 3

   If it fails with a FUSE error, install libfuse2 (on Ubuntu 24.04 the package is libfuse2t64).

4. 4

   Prefer a package? A .deb is on GitHub Releases: sudo apt install ./top-video-downloader_2.0.0_amd64.deb. Builds are x86-64 only.

How to check the SHA-256 checksum

A SHA-256 checksum is a fingerprint of the file: change a single byte and the value changes completely. Every GitHub release includes a SHA256SUMS file with one line per installer, in the form “checksum file name”. Our site shows the same value next to each download button, with a copy button. The strongest check uses two independent places: download from the site, take the checksum from GitHub.

Windows (PowerShell)

Get-FileHash .\top-video-downloader_2.0.0_x64-setup.exe -Algorithm SHA256

PowerShell prints the hash in uppercase and SHA256SUMS uses lowercase; case doesn't matter. To let PowerShell do the comparison, run the line below. It prints True when the file matches.

(Get-FileHash .\top-video-downloader_2.0.0_x64-setup.exe).Hash -eq "paste-the-checksum-here"

macOS (Terminal)

shasum -a 256 ~/Downloads/top-video-downloader_2.0.0_aarch64.dmg

Linux

sha256sum top-video-downloader_2.0.0_amd64.AppImage
# or, with SHA256SUMS in the same folder:
sha256sum -c SHA256SUMS --ignore-missing

The version in the file name changes with every release, so use the name of the file you actually downloaded. If the checksums don't match, don't run the file. Delete it and download it again from an official source. Still no match? Tell us on Telegram (see contact).

How in-app updates and yt-dlp updates are verified

App updates. Each release publishes a manifest, app-release.json, with the SHA-256 of every installer and an Ed25519 signature that covers the checksum, the version and the platform. The app hashes the downloaded update, compares the hash with the signed value and verifies the signature against a public key built into the app. On any mismatch, the update is not installed. The private signing key lives in the release pipeline's protected environment, not on a developer's computer and not on the account server.

yt-dlp updates. In 2.0 the download engine updates itself without a new app release. The app checks shortly after it starts and then every 6 hours. Each update is a zip archive signed with Ed25519 over its SHA-256. If the signature doesn't check out, the app keeps using the yt-dlp it shipped with. An installed update is re-verified at every start, and the bundled yt-dlp is verified before its first use.

Know where this stops: Ed25519 protects the updates the app fetches by itself. It is not a signature on the installer you download by hand. For a first install, your check is SHA-256.

Should I also scan the installer with VirusTotal?

For a second opinion, yes. Upload the installer to VirusTotal or search for its SHA-256 there; it runs the file through dozens of antivirus engines. We don't publish scan results here, so check the current file yourself. One or two hits from lesser-known engines, labelled “generic” or “heuristic”, are common for new unsigned software. If several major engines agree on a named threat, don't run the file, and let us know.