Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Itch.io is generally safe to browse and use, but downloading a game from it is not automatically safe. Itch.io is a self-publishing marketplace: almost anyone can upload a project, and the publisher—not itch.io—is responsible for the software they distribute.
The practical rule is simple: treat an unfamiliar itch.io download like any other executable from the internet. Check who sent it, inspect what you downloaded, keep your operating system protected, and do not disable security controls just to launch a game.
What “safe” means on itch.io
There are three different risks that are often mixed together:
- Browsing: Opening an itch.io page is normally low risk. itch.io itself says that viewing a page is safe.
- Downloading: Downloading an archive or installer carries the usual risk of malware and unwanted software.
- Running: Launching a native Windows, macOS, or Linux program gives that program an opportunity to interact with your computer, subject to the operating system and any sandboxing in use.
Itch.io performs server-side checks, but its own security warning says automated checks and human review are not perfect. It does not guarantee that every uploaded file is safe. The platform’s terms prohibit viruses and malicious code, but that prohibition is not the same as testing every game successfully.
#1 Best Overall
“Hosted on itch.io” therefore means that the file is being delivered through itch.io. It does not mean itch.io has certified the publisher or the executable.
When an itch.io download deserves the most suspicion
The highest-risk situation is not usually finding a game through a normal search. It is being pressured to download one.
A well-known scam starts with a message on Discord or another chat service: someone asks you to “test my game,” join a playtest, or review a project. The sender may be a stranger, or a friend whose account has been compromised. The download can be hosted on itch.io and still be malicious.
Reported consequences include stolen Discord accounts, browser compromise, password theft, and theft of stored payment information. A compromised account may then send the same message to the victim’s contacts.
Be especially cautious when:
- The request is unexpected or urgent.
- A friend suddenly writes in an unusual style or asks you to download an unfamiliar project.
- The download is a password-protected archive and the password is supplied in the message.
- The project contains an unexplained
.exe, installer, script, or launcher. - You are told to run the game as administrator or to bypass Windows Defender, Gatekeeper, or another security warning.
- The page’s description, screenshots, comments, and download do not appear to describe the same project.
None of these signs proves that a file is malicious. Together, they are a reason not to run it on your main computer or account.
Can an apparently legitimate project still be compromised?
Yes. An old page, an established developer account, or a game that has been available for a long time is useful context, not a security guarantee.
In a 2025 incident, a compromised developer account reportedly had legitimate game files replaced with a link to an .exe. The link remained available for a little over an hour before removal. This illustrates why checking a project’s history alone is insufficient: a legitimate account can be taken over and its files can change.
Rank #2
Before downloading, open the developer’s page and look for a consistent project history, normal update notes, meaningful community activity, and an expected file type. If a developer’s Discord message is the source of the link, verify the request through a separate channel rather than replying to the same account.
Which itch.io downloads are lower risk?
| Download type | Relative risk | What to remember |
|---|---|---|
| HTML5 game played in the browser | Lower | It normally runs in the browser sandbox. It is not risk-free: browser vulnerabilities and malicious web content remain possible. |
| Source code or an image, audio, or video file | Usually lower | Risk depends on the application opening it. Do not run included scripts or executables automatically. |
| Native game in a ZIP or other archive | Higher | Extract it, scan it, and inspect its contents before launching anything. |
| Installer, launcher, or standalone executable | Highest | It can make broader system changes and should be treated like software from any other unverified source. |
File format is only one factor. A browser game is not a universal safety guarantee, while a native game from a known developer may be perfectly legitimate. The point is to match your precautions to the software’s ability to access the system.
How to download an itch.io game more safely
- Use the official project page. Avoid links sent through unsolicited messages, URL shorteners, or pages that imitate itch.io.
- Check the publisher and release details. Look for a coherent description, screenshots, version information, and comments that match the project.
- Prefer the expected file. A Windows game should not suddenly require a suspicious script or an unrelated launcher. Do not assume a password-protected archive is safe.
- Scan before opening. Keep Microsoft Defender or your security software updated. On Windows, right-click the downloaded archive or executable and choose Scan with Microsoft Defender when available.
- Inspect the archive. Look for unexpected installers, scripts such as
.bat,.cmd,.ps1, or.vbs, and files unrelated to the game. Do not execute them just to see what they do. - Do not grant unnecessary privileges. A game that insists on administrator access should be treated as suspicious. If administrator access is genuinely required, verify why from the developer’s documentation.
- Use a separate environment for an unknown game. A spare computer, virtual machine, or a properly configured itch.io sandbox limits exposure better than your everyday device.
Virus scanners reduce risk but cannot prove that a file is safe. A clean result is one signal, not a certification.
What the itch.io app sandbox does—and does not do
The itch.io desktop app can run games in a sandbox. On Windows, a sandboxed game runs as a separate, less-privileged user. On Linux, the app can provide a separate per-game home directory. These restrictions can reduce what a game can read and write.
The sandbox is a containment layer, not a malware detector. It does not protect you if you voluntarily give an attacker a password, run untrusted software outside the sandbox, or encounter a vulnerability in a graphics driver. It also does not make every game harmless.
Windows
The first-time Windows setup creates an itch-player account using commands documented by itch.io:
net user itch-player salt /add
net localgroup Users itch-player /deleteSeeing C:Usersitch-player afterward is expected. It is the profile used by sandboxed games, not evidence that malware has installed itself.
Saves can be confusing. A normal save might be under C:Usersyourself, while the sandboxed copy is under C:Usersitch-player. For example, a Unity save could move from:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11C:UsersleafAppDataRoamingcom.unity.gameto:
C:Usersitch-playerAppDataRoamingcom.unity.gameChanging sandbox settings does not delete saves, but the game may stop finding them automatically. You may need to copy the save folder and give itch-player permission to access it.
macOS
The macOS app uses sandbox-exec and creates a policy file at:
{install_folder}/.itch/isolate-app.sbThe available policy modes are Balanced, the default hardened profile, and Legacy, which allows broader access for compatibility. In the app preferences, the relevant options are:
- Enable itch.io sandbox
- Disable network access in sandbox
- Policy mode
- Allowed environment variable names
Network access is allowed by default. Select Disable network access in sandbox if the game does not need online features and you want to reduce its reach.
The policy blocks several credential-related locations, including the itch.io, Google, and Mozilla application-support folders. It still allows some system and network activity, including process execution, Mach IPC, IOKit access, and network access unless you disable it. “Sandboxed” does not mean “unable to communicate with the operating system.”
If a game fails under Balanced mode, open Console.app and search for sandboxd denial messages. Try Legacy mode, then inspect the policy file and include the Console output when reporting the problem.
Linux
With sandbox type set to Auto, the app chooses Flatpak-spawn when running inside Flatpak, then Bubblewrap when bwrap is available, and finally Firejail.
Bubblewrap is the preferred backend in the current documentation. Its persistent game home is:
Recommended Free Tools
{install_folder}/.itch/homeTemporary files go in:
{install_folder}/.itch/tempThe temporary directory is cleaned when the game exits.
Firejail behaves differently: it does not redirect $HOME, so games write to your real home directory subject to blacklisted paths. Switching between Bubblewrap and Firejail can make saves appear to vanish because they are stored in different locations. The documentation generally does not recommend Firejail because its compatibility-focused blacklist can allow broader filesystem access than Bubblewrap.
Protect your itch.io account
Account security matters because a stolen account can be used to buy content, alter projects, or send convincing messages to other users.
- Open User settings → Security.
- Enable TOTP two-factor authentication with a supported authenticator app.
- Save the eight-digit recovery codes somewhere secure and offline.
- Use a unique password that you do not reuse on Discord, email, or other services.
- Never enter your password into a page reached from an unexpected message. Navigate to
itch.ioyourself.
Itch.io supports TOTP, not SMS-based two-factor authentication. After setup, login requires your password and a six-digit code that changes every 30 seconds. If valid codes are rejected, enable automatic network-based time adjustment on your phone; a clock mismatch can cause failures.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What to do if you already ran a suspicious file
- Disconnect the computer from the internet if you suspect active compromise. This can stop further communication, although it does not undo theft.
- Do not log in to sensitive accounts on that computer. Use a different, trusted device to change passwords.
- Change the passwords for email, Discord, itch.io, banking, and other important accounts. Start with email because it can reset other accounts.
- Revoke active sessions and tokens where each service provides that option, and enable TOTP.
- Run a full security scan. If the system shows signs of compromise, use an offline scan or reinstall the operating system rather than trusting a single clean scan.
- Contact your bank or payment provider if payment details may have been exposed. Monitor transactions.
- Report the project or post. Use the report button below an unwanted community post. For an account problem, email
support@itch.iofrom the address that owns the account and keep the resulting Ticket ID.
If the issue is only that a game crashes or will not start, itch.io directs users to the game’s page or purchase page and the publisher’s contact information. Itch.io does not provide technical support for individual games.
Best Value
Are paid itch.io games refundable?
Itch.io’s terms allow refund requests when purchased content cannot run, access is blocked, or the product does not match its description. For technical problems, support may ask you to contact the publisher first. Include your purchase information when contacting itch.io support.
Refunds involving an external key, such as a Steam key, can require the publisher to confirm cancellation because itch.io may not be able to disable that key. Payment processing can involve providers such as PayPal, Stripe, and Payoneer.
FAQ
Is it safe to browse itch.io?
Browsing an itch.io page is generally safe. The greater risk is downloading and running untrusted software from a project page, especially after an unsolicited message.
Free tools Windows power users keep installed
One-click scans. No signup required.
Does itch.io scan every game for viruses?
Itch.io performs server-side checks, but it does not guarantee that every upload is safe. Its own warning says automated checks and human review are imperfect, so a scan result or itch.io listing is not a security certification.
Is the itch.io app safer than downloading games directly?
The app can add sandboxing and manage installations, which may reduce the damage a game can do. It does not prove that a game is safe and does not protect against every attack. Treat the game itself as untrusted.
Is an HTML5 itch.io game safe?
HTML5 games normally run inside the browser sandbox and are generally lower risk than native executables. They are not risk-free because browser vulnerabilities and malicious web content remain possible.
Why did itch.io create a C:\Users\itch-player folder?
On Windows, this folder is the profile for the itch.io sandbox account. Its presence is expected when sandboxing is enabled and is not, by itself, evidence of malware.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesCan I trust a game because it comes from an old itch.io account?
No. Account age and a professional-looking page are useful context but not a guarantee. Accounts can be compromised and legitimate files can be replaced.
The Bottom Line
Bottom line: itch.io is a legitimate platform, and browsing it is generally safe. Its open self-publishing model means that not every download is verified safe. The sensible approach is to avoid unsolicited “test my game” links, inspect and scan native downloads, keep security protections enabled, use the itch.io sandbox where practical, and secure your account with TOTP. For unfamiliar executable files, “hosted on itch.io” should never be treated as proof that they are safe.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
