01
Record the hash outside
On the connected PC, open the product page over HTTPS and note the published SHA-256 — on paper, a photo, or the delivery form.
Verify, then run.
A NOKTRA build usually travels through an internet PC and a USB stick before it reaches the machine that matters. This page is the procedure for proving it arrived intact.
No public build has shipped yet. This page states, in advance, the policy every release will follow — so the procedure is on record before the first file is.
SHA-256
Check the fingerprint.
Every release publishes its SHA-256 hash on the product page, next to the download. One flipped bit anywhere produces a completely different value.
02
Carry the file in
Move the executable however your site allows — USB, data diode, transfer server. The path does not need to be trusted; the next step is what proves it.
03
Compute and compare inside
On the target machine, compute the hash with an OS built-in tool and compare all 64 characters. Match → the whole journey was clean. Mismatch → do not run it.
Built-in commands — nothing to install
Windows certutil -hashfile noktra-<tool>-<ver>.exe SHA256 macOS shasum -a 256 noktra-<tool>-<ver>.exe Linux sha256sum noktra-<tool>-<ver>.exe
Code signing
The signing policy
Public releasesFrom the first public release, builds are signed through an open-source code-signing service, with the signature verifiable in Windows file properties. Because the certificate belongs to the signing foundation, the publisher field may read the foundation's name rather than NOKTRA — the product pages will state exactly what to expect.
Closed networksFor sites that manage their own trust policy, NOKTRA can provide a release-signing certificate file for one-time registration in your environment. After that, every release verifies against it locally — no certificate authority, no network check, consistent with everything else here.
Either wayThe SHA-256 procedure above always applies, signature or not. A signature says who built it; the hash says nothing changed since. They answer different questions, so we publish both.