Is itch.io Safe to Download From? An Honest Answer

Features

itch.io is safe to browse and safe to play browser games on. Downloading and running an executable from it is exactly as safe as running any file sent to you by a stranger — because itch.io does not verify developers or scan their executables in any serious way.

That is the honest answer, and it is more useful than the two answers you will usually find. The platform is not a scam, and it is not a malware farm. It is an open upload site, and open upload sites work the way open upload sites work.

Here is what that means in practice, and the checks that actually help.

What itch.io does and does not do

itch.io lets anyone create an account and upload a file. There is no developer verification step, no code review, and no meaningful executable scanning before a file goes live. Moderation is largely reactive — the platform responds to reports rather than hunting for bad uploads, and users in itch.io’s own community forums report that some of their reports went unanswered.

This is not a secret and it is not a betrayal of the platform’s purpose. itch.io exists so that a seventeen-year-old can put a game jam build online in four minutes without asking permission. Every safeguard you add to that removes some of the thing that makes it valuable. Steam made the opposite trade and that is why finding anything on Steam is its own problem.

The three risk levels

Browser games: effectively zero risk

HTML5 games run inside your browser’s sandbox, with the same restrictions as any web page. They cannot touch your file system. If you only play browser games on itch.io, the safety question does not really apply to you.

The itch.io desktop app: low risk

The official desktop app installs games into managed folders and runs them sandboxed. It is the best default for anyone who downloads regularly, because it contains what a game can reach without asking you to think about it every time.

Downloading a raw executable: ordinary internet risk

This is where the actual exposure is. You are downloading an unsigned binary from an unverified stranger and running it with your user permissions. That is a normal thing to do on the internet and it is also how people get compromised.

The signals that do not work

Most advice on this topic lists trust signals that sound reasonable and do not survive contact with how attacks actually happen:

Account age. Hacked established accounts have been used to distribute malware. An old account is not a clean one.
Comments and ratings. Both get faked. An empty profile with comments disabled is a warning sign; a busy comment section is not an all-clear.
Multiple platform builds. Listing Linux and macOS downloads looks like effort. Faking those entries costs nothing.
A checksum on the page. A SHA-256 hash only proves the file matches what the same page told you to expect. It is worth nothing unless it comes from an independent source.
A clean VirusTotal scan. Some payloads download later, so there is nothing malicious in the file at upload time. Scanning still helps — just not as proof.

The signals that do work

The reliable pattern is not one check but a cluster of them, weighted toward is this page what it claims to be rather than does this file look clean:

Is this a duplicate of a game that exists elsewhere?

The most commonly reported attack on itch.io is a re-upload of a known game by an account that is not its developer. Community reports name fake uploads of well-known titles including Pokémon and GoldenEye clones. If you recognise the name, find the real home page first and follow the developer’s own link to itch.io rather than searching for it.

Does the file size match the screenshots?

High-quality screenshots attached to a tiny download is a mismatch worth questioning. It is not conclusive on its own — plenty of beautiful games are small — but combined with anything else on this list it is meaningful.

Is the download a nested archive?

A zip containing a zip containing an installer is a packaging pattern that exists to get past scanners. Legitimate indie builds are almost never structured that way.

Did a link in the comments send you there?

Never follow a “new version here” or “fixed build” link posted in a comment section or devlog. Malware has been distributed through exactly that route, including from accounts with real follower counts.

Does the developer exist outside itch.io?

A Bluesky or X account with a history, a Discord with actual people in it, devlogs that predate the release. None of this is proof, but a developer with a visible public trail is a very different proposition from an account that appeared last week.

The antivirus warning problem

Here is the part that makes this topic confusing: most antivirus warnings on itch.io downloads are false positives, and that fact is itself a risk.

Games built in Godot, Ren’Py and RPG Maker get flagged constantly, because those engines bundle an interpreter and a payload in ways that resemble packers. Unsigned executables trigger Windows SmartScreen as a matter of course, and code-signing certificates cost money that hobbyist developers do not have.

So players learn that the warnings are noise and start clicking through them. Which is exactly the habit an actual attack needs you to have. This is the real reason to use the desktop app or a sandbox: it means you never have to make that judgement call correctly under pressure.

What we would actually recommend

Play browser games freely. There is nothing to worry about.
Use the official itch.io desktop app for anything you download regularly.
For a one-off download from an account you do not know, run it in Windows Sandbox or a VM. This takes about two minutes to set up once.
Before downloading anything that shares a name with a game you have heard of, find the developer’s real page first.
Report pages that look wrong. Reactive moderation only works if people report.

And keep perspective: the overwhelming majority of the hundreds of thousands of things on itch.io are a student’s game jam entry that does nothing but run. The risk is real, concentrated and avoidable — not ambient.

Frequently asked questions

Is itch.io a legitimate website?

Yes. itch.io is a well-established independent game marketplace and hosting platform used by hundreds of thousands of developers, including many commercially released games. It is not a scam site.

Does itch.io scan games for viruses?

Not in any way you should rely on. itch.io does not verify developers or their executables, and its scanning is basic. Moderation is primarily reactive, based on user reports.

Why does my antivirus flag itch.io downloads?

Usually because the game is an unsigned executable built in an engine like Godot, Ren’Py or RPG Maker, which commonly trigger false positives. Unsigned builds also trigger Windows SmartScreen by default. These warnings are often noise — which is precisely why they are dangerous to get used to ignoring.

Are browser games on itch.io safe?

Yes. HTML5 games run inside your browser’s sandbox and cannot access your file system.

Is the itch.io app safer than downloading directly?

Yes. The desktop app installs into managed folders and runs games sandboxed, which limits what a malicious build can reach.

Has there actually been malware on itch.io?

Yes. Community reports include trojans hidden in nested archives of RPG Maker games, and fake uploads impersonating well-known titles from accounts that were not the real developers.

How do I report a suspicious game on itch.io?

Every project page has a report option. Because moderation is reactive, reporting is the main mechanism by which malicious uploads get removed.

Sources and citation

“Can games from itch.io be trusted anymore?” — itch.io community discussion, including moderator-adjacent accounts of what the platform does and does not scan, named malware incidents, and the trust signals that fail
“When trying to download a game, the system indicates a virus” — itch.io support thread on antivirus false positives
Google Trends — “is itch.io safe to download from” registering as a Breakout rising query, United States

Is itch.io Safe to Download From? An Honest Answer

What itch.io does and does not do