If you typed "where to" into a search box, you want a destination right now: a place to get software that is free, legal, and does not demand an account or a card. The best answer is to go straight to the project's own download page, then verify the file you got matches the checksum the publisher published. That single habit removes almost all the risk from downloading anything.
The Destinations That Fit You
Three places cover most of what you need, and each one suits a different job.
Apache is the first stop if you need server software, command-line tools, or libraries that run the internet. The Apache Software Foundation publishes its releases on its own site, and every download page lists a checksum for the file. You compute the checksum on the file you downloaded and compare it to the one they published. The current options are SHA-256 and SHA-512; the older SHA-1 and MD5 are marked deprecated, so skip those. This suits you if you are comfortable with a terminal or a file manager and want the actual source code or binaries without any installer wrapper.
SourceForge is the second stop, and it suits you if you want a huge catalog of open-source projects in one place. Each file listing includes MD5 and SHA1 checksums, and the documentation tells you to compare your downloaded file against those values. If the hashes do not match, the advice is to try a different mirror. This is the place for older or niche projects that do not host their own downloads anymore. It works in your browser, and you do not need an account to grab a file.
Internet Archive is the third stop, and it is different: it is a software library with historical software you can run directly in the browser. You do not download anything for many of these programs; you click and play. This suits you if you want to try an old game, a vintage operating system, or abandonware that is legally preserved. It is free, and it works without an account for most of the collection.
The Thing You Get Wrong
The biggest mistake is trusting the download button on a random website. Search results often show ads that look like the official page, and those ads lead to installers that bundle extra programs you did not ask for. The fix is simple: go to the official project page first, not a search result. If you are downloading from a mirror, use the official mirror list. If you are downloading from a project page, use the link on that page. Then, before you run the installer, check the checksum. That is the step almost everyone skips, and it is the step that catches a corrupted or tampered file.
What to Check Before You Commit
Before you double-click anything, do three checks. First, look at the URL. The official page will have a domain you recognize, like LibreOffice or Blender, not a misspelled variant. Second, look for a checksum or a signature file on the download page. If the project publishes one, you must use it. Third, if you are on Windows, you can use PowerShell to compute the hash and compare it. The command is Get-FileHash -Path "C:\path\to\file" -Algorithm SHA256, and you compare the output to the published value. If they do not match, delete the file and download it again from a different mirror.
For the bundled-installer trick, the rule is blunt: if the download page says "custom install" or "advanced install," you are about to get something extra. The safe path is to avoid any installer that tries to opt you into a toolbar, a browser extension, or a "offers" page. The official projects on this page do not do that. If you see a checkbox that says "recommended" next to something you did not ask for, uncheck it. If the installer does not give you that choice, cancel the install and find a different download.
What to Check Before You Commit: The Verification Step
You have the file, and you have the checksum. Now you need a tool to compute the hash. On Windows, PowerShell has the Get-FileHash cmdlet built in. On macOS, you use shasum -a 256 /path/to/file. On Linux, sha256sum /path/to/file. Compare the output to the published checksum. If they match, the file is exactly what the publisher released. If they do not match, do not run it. This is not paranoia; it is the only way to be certain you are not running something that was modified after the publisher signed it.
For extra safety, you can upload the file to VirusTotal before you run it. That service scans the file with dozens of antivirus engines. It is free, and it does not require an account. It is not a replacement for checking the checksum, but it is a second opinion. If you are downloading a portable app or a single executable, this is worth the extra minute.
What to Check Before You Commit: The Mirror Problem
SourceForge and Apache both use mirrors, and a mirror is just another server that hosts the same file. The checksum protects you because the hash is the same no matter which mirror you use. If you get a mismatch, the first thing to do is try a different mirror. The documentation says exactly that. Do not try to fix the file; just download it again from another location. If the hash matches on the second try, you are done.
What to Check Before You Commit: The Free Tier Reality
Every service on this page is free, and none of them require a card. But "free" has different meanings. Apache gives you the software and the source code, and you can use it for anything, including commercial work. SourceForge hosts projects that are open source, and you can download without an account. Internet Archive is a library, and it is funded by donations, not by selling your data. None of them put a paywall in front of the download button.
What you do give up is support. Free software does not come with a help desk. If you get stuck, you rely on forums, documentation, or the community. That is the trade-off. You are not paying with money, but you are paying with your time to learn the tool.
Frequently Asked Questions
What if the checksum does not match?
Delete the file immediately. Do not run it, do not try to repair it, do not upload it anywhere. Download it again from a different mirror or from the official page. A mismatch means the file is not what the publisher released, and that is the one thing you cannot ignore.
Do I need an account to download from these sites?
No. Apache, SourceForge, and Internet Archive all allow direct downloads without an account. You might see a "sign up for an account" button, but it is optional. If a site forces you to create an account before showing a download link, that is a sign you are on the wrong page.
Is it safe to run an installer from a mirror?
Yes, if you verify the checksum after the download. The mirror is just a copy of the file. The checksum tells you the copy is identical to the original. If the mirror served a modified file, the checksum would not match, and you would know to try another mirror.
What is the difference between SHA-256 and MD5?
MD5 is old and broken; it is possible to create two different files with the same MD5 hash. SHA-256 is current and secure. The Apache documentation lists SHA-256 and SHA-512 as current, and marks SHA-1 and MD5 as deprecated. Always use the strongest hash the publisher offers, which is almost always SHA-256.
Can I trust a file if the checksum matches but the site is not HTTPS?
No. If the site is not HTTPS, someone on the network could have modified the file and the checksum. The checksum only protects you if you get it from a secure connection. If the download page is not HTTPS, go to the official project page and find the checksum there, or skip the download entirely.
More on software
This is one of the guides in Where to Download Software Safely. The others:
.jpg){kind=link}