Is Frost Client safe to download?

Short answer: yes. Every Windows build we publish is scanned with VirusTotal, and we publish the exact file hash so you can check your own download matches what we built — not something that was swapped out in between.

Verify your own download

Don't take our word for it — check the file you actually downloaded against the hash for your system below. If the two match, your copy is byte-for-byte identical to the file we serve.

certutil -hashfile "Frost-Launcher-win.exe" SHA256

shasum -a 256 ~/Downloads/Frost-Launcher-mac.dmg

sha256sum Frost-Launcher-linux.AppImage

Compare the output to the SHA-256 value for your system above — every character should match. Browsers sometimes rename downloads (for example Frost-Launcher-win (1).exe); the name doesn't matter, only the hash does.

Why does my antivirus still warn me?

Occasionally Windows Defender SmartScreen or a specific antivirus engine flags the installer anyway, even with a clean VirusTotal result. That's a known, common situation for small independent apps and isn't a sign of anything malicious — it comes down to two things:

• No code-signing certificate yet. Commercial certificates cost money we're still working towards, so our installer is currently unsigned. Windows trusts a file partly based on how many people have already run it and whether it carries a paid signature — a new, unsigned build starts at zero reputation no matter how clean it actually is.
• Heuristic, not signature-based, detection. Some antivirus engines flag installers that download and write files after launch — which is exactly what any Minecraft launcher does — using generic behavioral rules rather than detecting anything specific in our code.

If SmartScreen blocks the installer, click More info → Run anyway. If your antivirus quarantines it and you'd like a second opinion beyond our own scan, the VirusTotal link above runs the same file through 50+ independent engines at once.

How we handle your Microsoft & Discord sign-in

Signing in to your Minecraft account happens entirely inside a Microsoft-hosted window — the launcher never sees your password, and neither do we. The Microsoft, Xbox and Minecraft tokens that come back from that sign-in are written to a config file on your own device and stay there; we never upload or store them on our servers.

• Your password never touches Frost. The Microsoft and Discord login screens you see are the real Microsoft/Discord pages, loaded directly — nothing you type on them passes through our code.
• Tokens are stored locally only. They live in the launcher's own config file on your device, never on a Frost server. As a fallback verification step — used only when your Discord-linked session data isn't available — your Minecraft token may be relayed through our server to Mojang's own API purely to confirm which account it belongs to; it's never written to disk or logged on our end.
• Discord sign-in only shares what its consent screen tells you it will. We request the standard identify scope (and, for staff/creator tools, read-only role membership) — your Discord password is never exposed to us, by design of how Discord's own login works.

Report a security concern

Found something that looks off, or want to report a real vulnerability? Reach out on Discord and ping a staff member directly rather than posting it publicly, so we can look into it before anyone else can act on it.