A proxy client is a special kind of software: it handles all of your network traffic, and in principle can see every address you visit. Which makes where you got it matter more than it does for anything else you install.
Three things here: how to verify a file, how to spot a bad installer, and how to judge an antivirus alert.
1. Why verify at all
Between the publisher and you, an installer can be altered at several points:
The principle is simple: the publisher publishes a hash of the file, you compute the hash of what you downloaded, and if they match the file has not been altered. Hash functions have the property that changing even one byte produces a completely different value.
2. Computing a file's hash
Windows (PowerShell, built in)
Get-FileHash .\Clash.Verge_2.5.2_x64-setup.exe -Algorithm SHA256Output looks like:
Algorithm Hash Path
--------- ---- ----
SHA256 A1B2C3D4E5F6...(64 hex characters) C:\...macOS / Linux
shasum -a 256 Clash.Verge_2.5.2_x64.dmg
# or
sha256sum Clash.Verge_2.5.2_amd64.debAndroid APKs
Awkward on the phone itself; copy it to a computer and use the commands above, or install a file manager that computes hashes.
Comparing
Check your value against the one on the release page. You do not need to read all 64 characters — comparing the first eight and last eight is plenty (a hash collision cannot be constructed to match that conveniently in practice).
Case does not matter; some tools output upper case and some lower, so normalise before comparing.
3. When no hash is published
Not every release publishes one. Two alternatives:
Option A: download from two sources and compare
Get one copy from here and one from the upstream GitHub release, then hash both. If they match, they are the same file — which indirectly demonstrates that we did not repackage anything.
Upstream project links are in the footer of every page on this site.
Option B: check the digital signature (Windows)
Right-click the exe → Properties → the Digital Signatures tab.
If there is a signature you can see the signer and timestamp. Two caveats:
- No signature does not mean something is wrong — code signing certificates cost real money annually and many open-source projects skip them
- A signature from a name you do not recognise is more concerning — that suggests someone re-signed it
4. Spotting a repackaged installer
Even without hashing, these signals tell you a lot:
| Signal | What it means |
|---|---|
| You got a "download accelerator" | A few hundred KB that then fetches the real software — with extras along the way |
| The installer offers bundled software | The genuine installer never asks whether you also want a browser, antivirus or toolbar |
| Filename says "portable", "cracked" or "patched" | Clash Verge is free and open source; there is nothing to crack |
| Version number does not add up | Advertised as the latest, but the version string is years old |
| New programs appear after installing | Icons on your desktop you did not put there |
| It asks you to disable your antivirus first | Legitimate software does not require this |
5. Antivirus alerts
Proxy software gets flagged frequently, and it is usually a false positive — but not automatically.
Why it happens
Deciding whether it is a false positive
Adding an exclusion once you are satisfied
Windows Defender: Settings → Privacy & security → Windows Security → Virus & threat protection → Manage settings → Exclusions → Add an exclusion → Folder → choose the Clash Verge install directory.
Third-party products put this under "trusted zone", "whitelist" or "exclusions"; searching the product name plus "exclusions" will find it.
6. Your subscription URL is part of this too
The installer being clean is only half of it:
Why free subscriptions of unknown origin are a bad idea: whoever provides the subscription can see where all of your traffic goes. A free service has to make money some other way, and traffic data is among the easiest things to monetise. That is not scaremongering — it is the basic economics of that kind of service.
7. A short download policy
In short
- SHA256 verification: one command, one minute, eliminates most of the risk
- No official hash: download from two sources and compare them
- An antivirus alert: judge by source first, then by how many engines agree; add a folder exclusion if it is a false positive
- Never touch "cracked" builds — this software is free, so there is only one reason such a package exists
Everything we host matches the upstream release with no repackaging, and you are welcome to verify that yourself using the methods above — every upstream project is linked in the footer.
Related: choosing an APK architecture and updating the client and core.
