Is PhotoCraft safe?

Start from the official project

The PhotoCraft repository links to getartcraft.com/apps/photocraft and storytold/photocraft releases on GitHub. Use those entry points rather than choosing an installer because its filename or search advertisement looks plausible. Our download guide links onward to the official files; we do not host a repackaged installer.

Check the release version, operating system and architecture. Save its release notes and checksum file with the download. Treat a separately maintained community package as a separate distribution decision. A request for a browser extension, unrelated downloader or security-settings change is a reason to stop and recheck the source.

Compare the exact file's SHA-256

The release documentation describes SHA256SUMS.txt. Get it from the same official release as the installer, then compare the complete hash against the line for that exact filename. Replace the example filename below with your downloaded file; these commands read it without launching the installer.

Windows · PowerShell

Get-FileHash -Algorithm SHA256 -LiteralPath '.\your-downloaded-file.msi'

macOS · Terminal

shasum -a 256 -- 'your-downloaded-file.dmg'

Linux · Terminal

sha256sum -- 'your-downloaded-file.AppImage'

Microsoft's hash documentation explains this integrity check. A mismatch means you should not run that file: check the selected release and download again from the official source. A match means the bytes match that published hash. It does not prove the program is harmless or protect against a compromised source that supplies both file and hash.

Verify signing; keep OS checks enabled

There is a distinction in the project's documentation: the README describes signed Windows and notarized macOS downloads, but the installation guide says signing is conditional on release secrets. An asset appearing on a release page alone does not prove it is signed. Check the specific file instead of treating either general statement as a guarantee.

On Windows, inspect the downloaded installer's signature and publisher. PowerShell's Get-AuthenticodeSignature can show its signature status and signing certificate:

Get-AuthenticodeSignature -LiteralPath '.\your-downloaded-file.msi' | Format-List Status, StatusMessage, SignerCertificate

On macOS, follow Apple's explanation of app warnings. Gatekeeper checks signing and notarization for downloaded apps. If the publisher is unexpected, a signature is invalid or the system reports malware, stop and investigate with the maintainer or your IT team. Do not disable antivirus or remove quarantine attributes simply to make an unknown download run.

Limit the risk to your work

Begin with a duplicate of a noncritical image. Save to a new filename, reopen the result and inspect its appearance and editable layers. Keep originals outside the test folder. Early-alpha reliability and PSD compatibility are separate from malware questions; our PhotoCraft vs Photoshop comparison explains a practical compatibility test.

The project's file-handling guide describes structured errors, decode limits and protections for some save paths. It also lists limitations. Unknown documents and embedded content remain untrusted inputs. For a suspicious file, use an isolated environment and follow your organization's handling process rather than opening it beside sensitive work.

We have not measured PhotoCraft's network activity or independently checked telemetry behavior. Local installation, available source code and the choice of implementation language do not establish a complete privacy guarantee. Avoid using confidential client material as your first test.

Treat MCP access as a separate decision

PhotoCraft exposes CLI and agent automation. Its automation security guide describes loopback TCP, bearer-token authentication and separate read/write workspace roots. It also documents missing general per-tool authorization and aggregate resource controls. Authentication identifies a connection; it does not make every requested operation appropriate.

For ordinary editing, leave agent integration unconfigured unless you need it. When evaluating automation, prefer the documented stdio setup, grant only a dedicated test folder, separate read and write access and protect tokens. Do not tunnel the unencrypted loopback protocol to another machine. These precautions narrow exposure; they do not replace reviewing the commands your agent can call.

If you find a potential vulnerability, follow the reporting policy. Share a minimal, non-exploitable description first and arrange a private channel before sending a malicious sample or sensitive logs. For a small image-only task, you can instead use our browser image compressor or pixelation tool without installing a desktop editor.