Verify download integrity and signing
Download only from hlsdownloader.com and the official CDN URLs listed here. Compare SHA-256 hashes and signing/notarization records for the exact version you install—hashes and signatures are separate facts.
What SHA-256 does—and does not—mean
- A matching SHA-256 proves the file you downloaded is the same bytes as the published artifact on this page. It does not by itself mean the software is safe, correctly signed, notarized, or that Windows SmartScreen or macOS Gatekeeper will allow it.
- Treat hash match, Authenticode/Gatekeeper results, and notarization status as independent checks. All must align with this page and your expectations before you install.
- If an OS warning appears, read the publisher and signing status shown by the OS. Do not install or bypass warnings solely because the hash matched.
Published artifacts (versioned CDN filenames)
Each row is tied to a specific release filename on our CDN. When we ship a new version, we add a new row here instead of reusing an old hash. Current site download links: Windows v2.3.7, macOS v2.3.7, Chrome ZIP v2.2.4.
| Filename | Version | Arch | URL | SHA-256 | Check date (UTC) |
|---|---|---|---|---|---|
| OFDownloader-2.3.7 Setup.exe | 2.3.7 | x64 | https://s3.hlsdownloader.com/easydownloader.app/win32/x64/OFDownloader-2.3.7%20Setup.exe | 420cf17eef7fe3b86755e0184b362e4075ffea1fe42d66523f39dd3eec0e79e3 | 2026-11-05 |
| OFDownloader-2.3.7-universal.dmg | 2.3.7 | universal | https://s3.hlsdownloader.com/easydownloader.app/darwin/universal/OFDownloader-2.3.7-universal.dmg | 0a3ab0c185213ca859a28e0e236ff9765af06f246ef843cf250d3a1d2de5f9c8 | 2026-11-05 |
| OFDownloader.app (inside DMG) | 2.3.7 | universal (x86_64, arm64) | https://s3.hlsdownloader.com/easydownloader.app/darwin/universal/OFDownloader-2.3.7-universal.dmg | — (integrity: verify DMG SHA-256 above) | 2026-11-05 |
| OFDownloader_chrome_2.2.4.zip | 2.2.4 | n/a (browser extension ZIP) | https://r2.hlsdownloader.com/crx/OFDownloader_chrome_2.2.4.zip | 98c70f664aa4218a0b549ee42e143c88832295cf66c0ee779cc3f1f3cf423748 | 2026-10-25 |
Signing and notarization status by release
Signing and notarization are verified separately from SHA-256. Windows was re-checked on 2026-11-05 (UTC) with osslsigncode. The macOS 2.3.7 DMG was re-read on 2026-11-05 (UTC) on Linux: SHA-256, the Developer ID certificate, and the Apple timestamp are from that file. That macOS 2.3.7 build is notarized and stapled. spctl was not run on this host, so that cell stays not yet verified. The Chrome ZIP hash remains the 2026-10-25 (UTC) check. Re-check on your machine before installing.
Windows — OFDownloader-2.3.7 Setup.exe
| Status | signed (EV code signing) |
|---|---|
| Subject / CN | SHIYIXIN LLC (O=SHIYIXIN LLC, L=Thornton, ST=Colorado, C=US; jurisdictionST=Colorado; serialNumber=20231710143) |
| Issuer | Certum Extended Validation Code Signing 2021 CA (Asseco Data Systems S.A.) |
| Leaf serial | 7074CF043D94BA0C94B2C0A1121CB51D |
| Thumbprint SHA-1 | 49:FC:A5:09:39:B7:7D:A3:C0:2B:82:CC:E6:C3:56:4A:B9:6F:F6:D5 |
| Thumbprint SHA-256 | 74:33:28:5B:41:1A:4D:00:9D:05:F1:C8:EB:3D:81:2B:9B:E7:70:27:39:45:90:A2:C8:8B:15:D9:F2:9D:58:86 |
| Timestamp | 2026-10-09 10:25:59 GMT SHA1 and 2026-10-09 10:26:03 GMT SHA256 (Certum Timestamp 2026) |
| Message digests | match (SHA1 and SHA256 Authenticode digests) |
| Verification result | Authenticode signatures present; SHA1 and SHA256 digests match; signature and CRL verification succeeded on the verifier host |
| Check date (UTC) | 2026-11-05 |
macOS — DMG and inner app (2.3.7)
| Layer | Signing authority | Team ID | Identifier / bundle ID | Notarization | Stapling | Timestamp |
|---|---|---|---|---|---|---|
| DMG (OFDownloader-2.3.7-universal.dmg) | Developer ID Application: zhao chufan (7D6ZA6VDJC) | 7D6ZA6VDJC | com.savemydayapp.of.dmg | notarized | stapled | 2026-10-09 08:55:58 GMT (Apple timestamp on the DMG signature) |
| Inner app (OFDownloader.app) | Developer ID Application: zhao chufan (7D6ZA6VDJC) | 7D6ZA6VDJC | com.savemydayapp.of | notarized | stapled | 2026-10-09 08:53:21 GMT (CMS signingTime, both slices) |
Chrome extension ZIP — OFDownloader_chrome_2.2.4.zip
code signing N/A (ZIP). The SHA-256 is for OFDownloader_chrome_2.2.4.zip v2.2.4, measured 2026-10-25 (UTC). It was not recomputed with the 2.3.7 desktop packages.
Inner app spctl: not yet verified. Format: Mach-O universal (x86_64 arm64).
Sample verification output (Windows 2.3.7, redacted host paths)
# Linux — osslsigncode, 2026-11-05 UTC $ osslsigncode verify -in ./OFDownloader-2.3.7\ Setup.exe Subject: .../CN=SHIYIXIN LLC Issuer: .../CN=Certum Extended Validation Code Signing 2021 CA Timestamp time: Oct 9 10:25:59 2026 GMT (SHA1); Oct 9 10:26:03 2026 GMT (SHA256) Message digests: match Signature CRL verification: ok Signature verification: ok Succeeded
On Windows, also run Get-AuthenticodeSignature and compare the publisher with the table above. SmartScreen reputation is separate from Authenticode digest/signature checks.
Windows verification
After downloading from the official URL, verify integrity:
Get-FileHash -Path "$env:USERPROFILE\Downloads\OFDownloader-2.3.7 Setup.exe" -Algorithm SHA256
Compare the hash with the published SHA-256 for v2.3.7. Then check signing separately:
Get-AuthenticodeSignature -FilePath "$env:USERPROFILE\Downloads\OFDownloader-2.3.7 Setup.exe" | Format-List
If Windows SmartScreen or Defender warns you
- Open the file's signing details and note the publisher name and whether the signature is valid.
- Compare those details with the signing table for this release. If the signature is invalid, unexpectedly missing, or the publisher does not match what we publish for that version, stop and contact [email protected].
- Do not continue installation or dismiss SmartScreen only because the SHA-256 hash matched.
macOS verification
Verify the DMG hash, then inspect signing on both the disk image and the app inside:
shasum -a 256 ~/Downloads/OFDownloader-2.3.7-universal.dmg spctl -a -vv -t install ~/Downloads/OFDownloader-2.3.7-universal.dmg # After mounting: codesign -dv --verbose=4 "/Volumes/OFDownloader/OFDownloader.app" spctl -a -vv "/Volumes/OFDownloader/OFDownloader.app" xcrun stapler validate ~/Downloads/OFDownloader-2.3.7-universal.dmg
If Gatekeeper blocks or warns
- For this exact version (2.3.7), compare Team ID, signing authority, notarization, and stapling with the macOS table on this page.
- A matching SHA-256 does not override Gatekeeper. Do not use workarounds (for example forced Open overrides) unless signing status matches the published record for that version.
- If status does not match the published record, stop and contact [email protected].
Chrome extension ZIP
Download from our installation guide or the official CDN (OFDownloader_chrome_2.2.4.zip, v2.2.4). Code signing does not apply to the ZIP; verify integrity only:
98c70f664aa4218a0b549ee42e143c88832295cf66c0ee779cc3f1f3cf423748
macOS / Linux (Terminal):
shasum -a 256 ~/Downloads/OFDownloader_chrome_2.2.4.zip
Windows (PowerShell):
Get-FileHash -Path "$env:USERPROFILE\Downloads\OFDownloader_chrome_2.2.4.zip" -Algorithm SHA256
Compare the output with the published hash before unpacking. Load only the unpacked folder in Chrome—never install from unknown mirrors.
GitHub Releases
Release notes live at GitHub Releases. As of 2026-10-25, recent tags in the GitHub API carry no binary assets—do not expect installer hashes there until upload assets are attached. When GitHub hosts binaries, we will sync checksums and signing notes to match this page.