Verify Many Tricks’ app downloads

Last change: January 17, 2017
[Time Sink 2]

The following table provides a SHA-2 cryptographic hash for each of our apps. Huh? What’s all that gobbledygook mean? Basically, it means you can use these hash values to insure that the app(s) you download from our server match what we uploaded to our server.

How can you check your download? After downloading one of our apps, open Terminal (in Applications > Utilities), type shasum -a 256 and then press the space bar, but don’t press Return. Now drag in the disk image (DMG) you downloaded from our site, and press Return. Here’s what you’d see for Butler (version 4.1.23) if you were to do that:

$ shasum -a 256 butler4123.dmg 
7de67e08e0bcffbdf3c5a2af73f84654b7dc5db5e95d61e42e74d863eb3d06fc butler4123.dmg

That big string starting with 7de67e08e0bc… is the SHA-2 hash, and that’s the value you want to check against the table below. If the string shown in Terminal differs from what’s shown in the table below for the same app, please let us know, and do not install the app!

Main Apps Version SHA-2 Hash
Butler 4.1.23 7de67e08e0bcffbdf3c5a2af73f84654b7dc5db5e95d61e42e74d863eb3d06fc
Desktop Curtain 3.0.7 3eb05d9b6d17f978d23a518ecfc1663e077f5844010493aa682638c5a2b82114
Keymo 1.2.5 7eb685ae806e0bcf251cf74d18890ef07d75dc31bc92323ff66efdf8b56476a0
Leech 3.1 e8553da6c6eaca569e87b0188b7c0bb6eab64dbc874c8c151768c6bf96c2470e
Moom 3.2.6 482dd69788ac707f13483631eae5aaef7fcc356b688d51e359a3b69fc531a143
Name Mangler 3.4 460f802b90e0e0123d397199600b68adf609e656e51a7b23f38bdf9eec05c91e
Resolutionator 1.1.1 b4e0ba696aeee124c8d701371af71c4d1702fe0333fb955e3e5492d10f6ef679
Time Sink 2.0 7ba8ad0833dfe5e1b24be7f0b2afb2a443b2d3f25ad285c6a017218575cba103
Usher 1.1.15 dae864e345585586bb3a29f4157dc1d24275a32213b7f3dbca7ab6ce8ed8f36c
Witch 3.9.9 e06e524d054fce30aa55f3031c99659e54b9b6d8d86fca20b682b2d6cf97cc8c
Baubleries Version SHA-2 Hash
Displaperture 1.4 ce6d01fbb300d32f81ff1123d20804ac6eeb5b6b650c1d80e09105c58679db72
Key Codes 2.1 60ec4c0cef5e97943c91e4ed317434bcaddd4cdbce93368d8bca9db9d45c60e2
Menu Bar Tint 1.2 cecdb96f99680af3da052963ebaf92a61e5c14cc3d1b5fac75bedd76122470d5
Open-With Manager 0.9.2 1cedc9a11488f704e67261483f3ac2b52039e701931133d4d0fd431024c00c62
Safari Guardian 1.2.2 cbe6588f8407eae91015378f5d02c8a2ba19cf13c37f888a892c8f39fc268a72
Service Scrubber 1.1.5 4377717775344b7ac99a577813e2ed328e0b7c283d5a43799bbf41f7537b20ea

Note: If you would like to verify an older version of any of our apps, please contact us with the app name and version number, and we’ll send you the SHA-2 hash.

SHA-2 hashes are long and complicated, so comparing them can be a bit of a pain. Here’s a way to make the task simpler. Assuming you’ve already downloaded an app, copy (double-click the hash then press Command-C) that app’s hash value from the above table.

Next, in Terminal, type expr `shasum -a 256 and press the space bar. Drag in the downloaded DMG file, which will add its complete path to what you’ve typed. Press the space bar again, then type (or paste) | cut -d ' ' -f 1` =. Finally, press the space bar once more, then press Command-V to paste your copied value. The final command will look something like this (for Moom 3.2.6):

expr `shasum -a 256 moom326.dmg | cut -d ' ' -f 1` = 482dd69788ac707f13483631eae5aaef7fcc356b688d51e359a3b69fc531a143

When you press Return, the output will either be 0 or 1. If it’s 1, all is fine—the above command compares the two values, and if they’re the same, it returns 1. But if you get a 0 as the returned value, then the hashes disagree. Please do not install the app you downloaded, and contact us immediately.

This table will be updated each time we update any of our apps.

Comments are closed.