Tested on: Windows 11 25H2, VirusTotal & Google Safe Browsing
Is itch.io safe? Yes. itch.io is a legitimate indie game store that has operated since 2013, not a scam or adware site. But anyone can upload a game without code vetting, so your safety depends on the individual game page you download from.
Quick summary: This guide is for players who want free indie games without risking their PC. Verdict: safe as a platform, risky only when you run unverified files. The numbers that matter: 92 of 93 security vendors marked itch.io clean on VirusTotal (one regional false positive), and Google Safe Browsing tells users to “Check a specific URL” instead of trusting the root domain blindly.
What Happened When I Checked itch.io on VirusTotal and Google Safe Browsing
I started with the two checks most readers trust: a VirusTotal URL scan and the Google Safe Browsing site status page.
VirusTotal: 1/93, and why the red “1” is not a reason to panic
I scanned http://itch.io/, which redirected to https://itch.io/ (IP 104.26.8.198, status 200). The result was 1/93. Only one vendor, Chong Lua Dao, marked it “Malicious”. The other 92, including Acronis, AlienVault, Antiy-AVL, Google, Kaspersky and Microsoft, marked it Clean. The community score was +16, with 26 community comments.
My reading, which the vendor has not confirmed, is that this is a classic false positive. itch.io lets creators publish on their own subdomains (username.itch.io). When one of those is reported for spam or phishing, an aggressive regional blocklist can end up flagging the root domain. A single flag against 92 clean verdicts, from the engines most people actually run, looks like that pattern rather than a malware infection.
Google Safe Browsing: “Check a specific URL”
Google did not show a simple green badge. It showed “Check a specific URL” and explained that it is hard to give a simple safety status for sites with a lot of content, because generally safe sites sometimes contain some unsafe content.
That is the core of this whole review. Google treats itch.io as a generally safe platform, but it does not vouch for every project page on it. Safety lives at the level of creator.itch.io/game-name, so that is where you should check.
My Free Game Download Test on Windows 11 (And Why SmartScreen Complains)
Downloading a free game from itch.io was smooth. I clicked Download on a free indie game, and the “Name your own price” box appeared. Clicking “No thanks, just take me to the downloads” gave me the file for $0, with no account login and no request to disable my ad blocker.
That is the opposite of my Softonic download test, where the download failed until I paused the ad blocker and I received an outdated installer. On itch.io the file comes straight from the creator, with no third-party wrapper in between.
Even so, clean indie games often trigger Windows warnings, for two reasons:
- No code-signing certificate. Hobbyist developers rarely pay the several hundred dollars a year that signing certificates cost, so Microsoft Defender SmartScreen shows “Windows protected your PC” with an “Unknown Publisher” label.
- Engine false positives. Games built with Godot, Ren’Py, RPG Maker or Unity bundle scripts and runtimes that heuristic scanners sometimes mistake for packers.
An “Unknown Publisher” banner alone is not proof of malware. It does mean nobody has vouched for the file, which is why the checks below matter.
The 3 Real Risk Levels on itch.io: Browser vs App vs Raw EXE
How you play matters more than the site itself.
| Method | Risk | Why |
|---|---|---|
| Browser games (HTML5) | Near-zero | Runs inside the browser sandbox and cannot touch your Windows files. |
| Official itch.io desktop app | Low | Installs games into managed folders and offers an optional sandbox that runs them under a restricted Windows user account. |
| Direct .exe / .zip download | Standard internet risk | Runs with your full Windows account permissions unless you verify it first. |
If you use the app, download it only from the official itch.io app page and check the publisher shown in the Windows prompt before installing.
5 Red Flags That Spot Fake or Malicious Games (2-Minute Check)
- The “try my game” Discord DM. A stranger asks you to playtest an itch.io link. The goal is usually stealing Discord tokens and browser cookies. Never run a file from an unsolicited message.
- Re-uploads of famous games. Fake accounts clone well-known titles, or a commenter claims a “fixed build” is available elsewhere. Check the creator’s name and account history.
- Password-protected .zip or .rar files. A password stops scanners from inspecting the contents. A free indie game rarely needs one.
- Nested archives or odd file types. A zip inside a zip, or files like
.bat,.cmd,.scrand.lnkinstead of normal game assets, are warning signs. - “Disable Windows Defender to run it.” Never do this. Instead, scan the project URL with my guide to checking if a link is safe, then scan the downloaded file before opening it.
itch.io or Steam: Quick Decision Guide
- Choose browser play on itch.io if you want to try a game instantly with the lowest risk.
- Choose the itch.io desktop app (sandbox on) if you play many indie games and want managed installs with extra isolation.
- Choose Steam or GOG if you want a curated store and do not want to judge individual creators.
- Skip the download immediately if the file is password-protected, nested in archives, or the page tells you to turn off your antivirus.
Pros and Cons From My Test
| Pros | Cons |
|---|---|
| 92 of 93 VirusTotal vendors marked it clean | One regional vendor still flags the root domain |
| Free download worked with my ad blocker on, no login | Anyone can upload, with no pre-release code vetting |
| Browser games are sandboxed by design | Raw .exe files can trigger SmartScreen warnings |
| Optional sandbox in the official desktop app | Google asks you to check each project page yourself |
Frequently Asked Questions
Is itch.io safe to download games from?
Why did VirusTotal flag itch.io with 1 malicious detection (Chong Lua Dao)?
Why does Google Safe Browsing say "Check a specific URL" for itch.io?
Are browser games on itch.io completely safe?
Does the itch.io desktop app protect against viruses?
Is itch.io safe for kids and parents?
Final Verdict
itch.io is a good fit for players who enjoy indie games and are willing to spend two minutes checking a page before downloading. My VirusTotal scan returned 1/93 (a single regional false positive), and Google Safe Browsing asks you to check specific URLs rather than the whole site. The golden rule: play HTML5 games in your browser, turn on sandboxing in the desktop app, and scan raw executables before clicking Run. If you want zero judgment calls, Steam or GOG is the easier route.
