Updated July 2026 · 6 min read
Verify download source and signature
There is exactly one source worth trusting for this client: the project GitHub Release page. Download portals, high-speed downloaders and so-called clean editions in the search results cannot prove the file was left untouched.
Check who owns the repository first
The top search results are often aggregator download sites, and some of them look more official than the real thing. Confirm the author name and the project name in the repository path, open the Release page, and take only the files listed there as assets.
A third-party mirror is not a substitute even when the file name matches exactly. You cannot tell which build it was copied from or whether it was repackaged along the way, and if something goes wrong there is nothing to compare against.
Read the platform and architecture in the name
One release carries packages for several platforms at once: x64 and arm64 for Windows, installer and portable, Intel and Apple silicon for macOS, deb and rpm for Linux. The version number and those suffixes are all in the file name.
Grabbing the wrong architecture rarely produces a helpful message. It either refuses to install or starts once and vanishes. If you are unsure, Windows shows the device specification in the system information panel and macOS shows the chip in the about panel.
If the hash does not match, do not install it. If a second download also fails to match, change networks — the transfer is most likely being intercepted or truncated on the way.
Use the checksum published with the release
When the release page lists a checksum, compute your own before installing: Get-FileHash in PowerShell on Windows, shasum -a 256 on macOS and Linux, then compare the strings character by character. Install only on an exact match.
A hash only proves the file matches what that page claims, so the page itself has to be genuine — a matching hash from a fake site means nothing. If a release publishes no checksum at all, at least make sure the file really came from the Release page.
Downloaders, repacks and antivirus alerts
What a download portal hands you is a downloader, not the installer, and clean editions or translated builds are somebody else repackaging the program. This client is open source and free, so no third-party accelerator or crack has any reason to exist; the extra layer only adds risk.
A fresh release has little signature reputation, so a SmartScreen prompt or a single engine reporting something unknown is common. Check the hash first, then see whether a multi-engine scan flags it broadly or only once or twice; the file properties dialog also tells you whether a digital signature tab exists. Allowing it through is covered in its own guide.
What is the project?
Clash Verge Rev is a Tauri-based GUI for Mihomo with profile management, system proxy, TUN mode, rule editing and WebDAV backups.