The right file, straight from GitHub.
Paste a repository or release link, check your system, and press Find download. You get one file, a direct GitHub link, and a report on where it came from.
Built for your machine
Matched to your system and chip from the file names. Unclear names are never guessed.
Proof of origin
Build attestations, GitHub’s SHA-256 digest, and whether the file changed after release.
Known-malware check
The file’s fingerprint is looked up on VirusTotal. Nothing is uploaded.
How it
works
Steps
03
How it works
- 1
Paste a link
Any public github.com repository or release URL. We read only the owner, repo and tag.
- 2
We match your machine
Latest stable release, then the file built for your OS and CPU.
- 3
Download from GitHub
The button links straight to the file. Nothing is mirrored or installed.
Is this file really theirs?
Binaries get mirrored, re-hosted and passed around in chat. Drop one here and we’ll check it against the project’s own GitHub releases.
Byte-for-byte match
Finds the exact release file with the same SHA-256, and tells you if it's outdated.
Attestations, not vibes
Checks whether GitHub holds signed build provenance for those exact bytes.
Nothing uploaded
Your browser hashes the file. Only the 64-character digest is sent.
In a terminal: oqgit verify ./file owner/repo
Review a pull request
Gemma 4 ranks what's wrong, tells you if it's safe to merge and writes one prompt to fix it.