Safety
Is LibreSprite safe?
We downloaded every LibreSprite 1.3 build from the official GitHub release, hashed it, scanned the Windows files with Microsoft Defender, inspected the code signatures on Windows and macOS, and ran each one. Here is what we found and why your system may still warn you.
On this page 8 sections
Short answer
Verdict
Yes, LibreSprite is safe when you download it from its official GitHub releases (or Flathub, or your Linux distribution). It is open-source software with public code, Defender found no threats in the 1.3 downloads, and nothing in our tests behaved unexpectedly. Warnings from Windows SmartScreen or macOS Gatekeeper appear because the builds are not signed by Microsoft or Apple, not because anything harmful was detected.
What we checked
| Check | Result |
|---|---|
| Source of the files | The 1.3 release on github.com/LibreSprite/LibreSprite, built by the project’s public GitHub Actions workflows |
| SHA-256 of each build | Computed by us on November 1, 2026; listed on the download page so you can compare yours |
| Microsoft Defender scan (installer and zip) | “found no threats” on Windows Server 2025 and Windows 11 Arm64 |
| Windows code signature | Not signed (installer and libresprite.exe) |
| macOS code signature | Ad-hoc signature, valid; no Apple Developer ID; not notarized |
| Network access | No update check or telemetry in 1.3: its only network code serves scripts that you run and that explicitly fetch something |
| What the installer changes | Program files in C:\Program Files\LibreSprite, a Start menu entry, an “Open with” entry for .ase; the uninstaller removed the program folder completely |
Why an antivirus or SmartScreen may warn
Unsigned programs with few downloads are judged by reputation, not by what they do. Two consequences:
- Windows SmartScreen may show “Windows protected your PC” for the unsigned installer. Click More info → Run anyway after checking the file name and SHA-256. (No prompt appeared on our test machines.)
- Some antivirus engines flag unsigned installers generically. In 2020 a user reported a few VirusTotal detections for an old LibreSprite installer (issue #80); those were low-confidence generic hits. You can check the 1.3 files yourself on VirusTotal by their hashes, for example the installer: 7e03e5b1…de036d.
“Damaged” or “Not Opened” on a Mac is not a malware detection
macOS shows “Apple could not verify “libresprite” is free of malware…” or “is damaged and can’t be opened” for downloaded apps that are not notarized by Apple. It did so for both official 1.3 DMGs on our test Macs. It is a missing Apple signature, not a finding. The fix and the safer alternatives are on Install on Mac.
Android: “Unsafe app blocked”
Google Play Protect can block the official 1.2 APK with a message about the app being built for an older version of Android (#597). That is about the app’s target SDK, not malware. See LibreSprite on Android.
Official and unofficial sources
| Source | Status |
|---|---|
| github.com/LibreSprite/LibreSprite/releases | official the only place the project publishes builds |
Flathub (com.github.libresprite.LibreSprite) | official listing currently one release behind: it builds 1.2 (the listing says 1.1-dev) |
| Arch, openSUSE, Void, Alpine, Fedora, Guix, Scoop… | trusted built from source by each distribution’s maintainers |
| libresprite.github.io | official website links to GitHub |
| Softonic, SourceForge mirrors, Uptodown and other download portals | unofficial may be old or repackaged; use GitHub instead |
| “LibreSprite Mac” uploads on itch.io | avoid unofficial builds; one served a file named Aseprite.app |
| libresprite.org | dead old domain, no longer the project’s |
| libresprite.dev (this site) | independent guide never hosts or modifies the program |
Are LibreSprite scripts safe?
Scripts are JavaScript files you put in the scripts folder and run from the Scripts menu. Treat them like any program you download: only run scripts you trust. Version 1.3 fixed several script sandbox escapes, and the development version (after 1.3) adds permission prompts for scripts that want to use the network or start programs. Read a script before running it; most are short.
Is Aseprite safe?
Aseprite from its official sources (aseprite.org, Steam, itch.io by its developers, or compiled from its GitHub source) is safe. “Free Aseprite” downloads from other sites are cracked or re-uploaded copies that its licence forbids sharing, and the usual way malware spreads. Is Aseprite free? explains the legal routes.
FAQ
Is LibreSprite a virus?
No. LibreSprite is a well-known open-source program (GPL-2.0, 8,703 GitHub stars). Download it only from GitHub, Flathub or your distribution, and check the SHA-256 if you want to be sure your copy is genuine.
Is LibreSprite legal?
Yes. It is based on Aseprite’s code from the time Aseprite was published under the GPL, which allows anyone to copy, modify and share it. The fork is legal and credits Aseprite’s original author.
Does LibreSprite collect data?
No. 1.3 has no telemetry, no account and no automatic update check.
Keep going
Found something wrong or out of date? Tell us: hello@libresprite.dev. We fix mistakes within a day.