“Is PDF Arranger safe?” is the right question to ask about any free program you download from the internet, and it deserves a factual answer rather than a badge. This page lays out what can actually be verified about PDF Arranger — its licence, its source code, where the genuine files live, and how to check a download yourself — and it is equally clear about the real risks, which have less to do with the program than with where people get it.
The verifiable facts
- It is open source, under GPL-3.0-or-later. The full source code is public in the project’s GitHub repository (pdfarranger/pdfarranger), where anyone — including security researchers and the Linux distributions that package it — can read exactly what the program does. Open code does not prove a program is harmless, but it removes the need to take the developer’s word for anything.
- It runs locally and offline. PDF Arranger is a desktop application with no account, no sign-in and no upload step: your documents are processed on your own computer and never sent to a server run by the project. For sensitive documents, that architecture matters more than any promise on a download page.
- There are no paid tiers or bundled extras in the official packages. The program is free software maintained as an open-source project; the official Windows installer and portable ZIP contain the application itself.
Where genuine copies come from
The official sources are short and specific. On Windows, the genuine files are the installer and portable ZIP attached to releases in the project’s GitHub repository. On Linux, the recommended routes are the Flathub Flatpak listing and your distribution’s own repository. macOS has no official package at all — the project documents only running it through Nix or from source — so any website offering a ready-made Mac installer download for PDF Arranger is offering something the project never made, and it should not be trusted. This site’s position is simple: we only link to official sources, starting with our download page and the Windows installation guide.
Check your download yourself: the 1.14.0 hashes
For the current release, version 1.14.0 (May 23, 2026), the official GitHub release metadata lists these SHA-256 hashes:
- Installer (pdfarranger-1.14.0-windows-installer.msi):
33ba1c3028cc81eb364b8eed288389fc8a4869c015ce817b9408a3d31e0e90b0 - Portable ZIP (pdfarranger-1.14.0-windows-portable.zip):
71bb8c7d3e9bd1713424ec546681f4cf4d50961020607e1c154ade67ea532615
Verifying takes a minute. On Windows, open PowerShell in the folder where you saved the file and run Get-FileHash .\pdfarranger-1.14.0-windows-installer.msi -Algorithm SHA256; on Linux, run sha256sum followed by the file name. If the long string your computer prints matches the one above, character for character, you have the genuine file the project published. If it does not match, delete the download and get it again from the official source — a mismatch means the file was altered or corrupted on its way to you.
The real risks to watch
The honest risks around a program like this live on third-party download sites, not in the official release. Aggregator sites repackage popular free software, sometimes with altered installers or extra bundled programs riding along, and lookalike pages exist for almost every well-known free tool. The defences are boring and effective: download only from the official sources named above, verify the hash when you can, and be suspicious of any site that wraps the program in its own downloader or asks you to install something else first. Note, too, what this page deliberately does not claim: we make no promises based on third-party scanning services, and no software can honestly be declared risk-free in the abstract — what can be checked, we have shown you how to check.
What about antivirus warnings?
Occasionally a lesser-known free program triggers a generic warning from a cautious antivirus product, especially a brand-new release that few people have downloaded yet. A generic warning is not proof of anything in either direction, and this site will not wave it away with slogans. The checkable responses are the ones already on this page: confirm the file’s hash matches the official release exactly, and confirm the installer came from the official repository rather than a repackaging site. A file that passes both checks is the same file the project’s own maintainers published; a file that fails either check should be deleted without debate.