How to Verify App Signatures and Check File Integrity in Windows 11

In this article

1. Understanding Digital Signatures and File Integrity
2. Method 1: Checking File Properties Graphically
3. Method 2: Verify App Signatures Using PowerShell
4. Method 3: Deep File Integrity and Signature Auditing with Sigcheck
5. Step 1: Download and Set Up Sigcheck
6. Step 2: Run Basic and Advanced Sigcheck Commands
7. Best Practices for Maintaining File Integrity
8. Frequently Asked Questions
9. What does a ‘HashMismatch’ error mean in PowerShell?
10. Can an executable have a valid signature and still be malicious?
11. What is the difference between checking a file hash and verifying a digital signature?

Downloading software from the internet carries an inherent risk. Even if a download page appears legitimate, executables can be intercepted, modified, or replaced. While Windows 11 includes built-in defenses like SmartScreen, knowing how to verify app signature windows 11 manually gives you direct cryptographic confirmation that a file originates from its claimed publisher and remains unmodified.

This guide explains how to inspect digital certificates using native graphical interfaces, query file signatures via PowerShell, and perform deep integrity audits using Microsoft’s Sigcheck utility.

Understanding Digital Signatures and File Integrity

When developers build an application, they typically sign the executable (.exe, .dll, or .msi) using a digital certificate issued by a trusted Certificate Authority (CA). This signature serves two core functions:

• Authentication: Confirms the identity of the software publisher.
• Integrity: Relies on a cryptographic hash to ensure the code has not been altered since signing. Any modification to the binary immediately breaks the signature.

If an executable lacks a valid signature or uses an untrusted certificate, Windows 11 usually displays a warning prompt. However, administrators and power users frequently need to perform independent manual or automated checks before deploying binaries in sensitive environments.

Method 1: Checking File Properties Graphically

You can perform a quick visual inspection using the standard Windows properties menu before moving to the command line.

1. Right-click the executable file and select Properties.
2. Navigate to the Digital Signatures tab. If this tab is absent, the file is unsigned.
3. Select the signer’s name in the signature list and click Details.
4. Review the status message at the top of the details window. A healthy signature reads, “This digital signature is OK.”
5. Click View Certificate to verify that the certification path chains back to a trusted root authority.

While graphical inspection is straightforward, it is impractical for auditing multiple files or automating workflows.

Method 2: Verify App Signatures Using PowerShell

Windows 11 includes built-in PowerShell cmdlets designed to query Authenticode signatures. The primary tool for this task is Get-AuthenticodeSignature.

Open PowerShell and run the following command with your target file path:

Get-AuthenticodeSignature -FilePath “C:\Path\To\Your\File.exe”

The command returns an object containing several key fields:

• Status: The primary indicator. A valid signature returns Valid. Other possible values include NotSigned, HashMismatch (indicating file modification), or UntrustedRoot.
• SignerCertificate: Information regarding the entity that signed the binary.
• TimeStamped: Confirms whether a secure timestamp was applied, preserving signature validity even if the developer’s code-signing certificate expires.

To evaluate multiple files within a directory recursively, combine the cmdlet with file enumeration:

Get-ChildItem “C:\Tools” -Filter *.exe | Get-AuthenticodeSignature

This outputs a list of all target executables along with their respective signature states, helping you quickly identify unsigned binaries.

Method 3: Deep File Integrity and Signature Auditing with Sigcheck

For advanced technical requirements—such as reviewing SHA-256 hashes, checking timestamps, or querying catalog files—native tools have limitations. Microsoft’s official Sigcheck utility addresses these scenarios.

Part of the Sysinternals suite, Sigcheck is a lightweight, standalone command-line tool built for deep file integrity and signature verification.

Step 1: Download and Set Up Sigcheck

1. Download Sigcheck from the official Microsoft Learn Sysinternals page.
2. Extract the package to a permanent directory, such as C:\Sysinternals.
3. Add the folder to your system PATH environment variable for global terminal access, or navigate directly to the directory before executing commands.

Step 2: Run Basic and Advanced Sigcheck Commands

Open Terminal or Command Prompt as an administrator. To inspect an individual file’s certificate chain and cryptographic hashes, run:

sigcheck.exe -i “C:\Path\To\File.exe”

The -i switch displays detailed certificate attributes and verifies root trust.

To generate standard file hashes alongside the signature check, use the hash parameter:

sigcheck.exe -h “C:\Path\To\File.exe”

This command outputs MD5, SHA-1, and SHA-256 hashes, which you can compare against checksums published by the software vendor.

To scan an entire directory recursively and flag unsigned or altered files, use the following flags:

sigcheck.exe -e -s -v “C:\Path\To\AuditFolder”

• -e: Scans executable file formats (exe, dll, sys).
• -s: Recurses through subdirectories.
• -v: Validates against local rules or queries VirusTotal if terms are accepted.

Best Practices for Maintaining File Integrity

Cryptographic verification works best when paired with sound sourcing habits:

• Use official channels: Obtain software directly from developer websites or verified repositories like official GitHub releases, avoiding third-party aggregators.
• Verify checksums independently: If developers supply a SHA-256 hash, check it locally using PowerShell’s Get-FileHash cmdlet to confirm exact file integrity.
• Respect SmartScreen warnings: Do not bypass Windows SmartScreen prompts unless you have independently verified the publisher’s certificate and trust the source.

Frequently Asked Questions

What does a ‘HashMismatch’ error mean in PowerShell?

A HashMismatch status indicates that the file’s current contents no longer match the cryptographic hash recorded when the binary was signed. This points to file modification, corruption, or tampering, and the executable should not be run.

Can an executable have a valid signature and still be malicious?

Yes. A digital signature verifies who signed a file and that it hasn’t changed since signing. Attackers occasionally abuse or compromise legitimate code-signing certificates to sign malicious payloads. Signature verification should always be paired with behavioral monitoring and threat intelligence.

What is the difference between checking a file hash and verifying a digital signature?

A file hash checks whether a file matches a known reference copy bit-for-bit. A digital signature uses public-key cryptography to bind a publisher’s identity to the code, verifying both the issuer and the file’s integrity.