Provenance and published hashes
Is Lichii safe?
Start with the hosts named by the project, then compare the file name, size and published SHA-256. This page links the release channel and gives the commands for checking the downloaded bytes.
Hosts the project actually points at
| Use | Address | Why it is on this list |
|---|---|---|
| Source and issues | github.com/zortos293/Lichii | Repository named by the maintainers |
| Downloads | GitHub releases | Only published file channel |
| Old name | github.com/zortos293/Eglantine | Redirects to the Lichii repository |
| Compatibility | lichii.zortos.me | Linked from the README |
| Chat | discord.gg/UugGDDGDx5 | Maintainer posted it on issue 24 |
| Upstream, different project | Djihads80/Eglantine | Not the Lichii release |
Three checks before you run a file
Download only from the build-93 tag. Compare the file name, the byte size, and the SHA-256 on the download page of this site with the release page. Windows: certutil -hashfile. macOS: shasum -a 256. Linux: sha256sum. If they differ, delete the file. Do not fetch a replacement from a mirror.
The license is GPL-3.0 and the source is public. Eden and yuzu notices stay in the tree. Windows is a zip, not an installer. macOS is not notarized, so Gatekeeper will complain. SmartScreen may complain on Windows. Those prompts are expected for an unsigned experimental build. They are not, by themselves, proof of a tampered file. The hash is the check.
Release uploads for recent tags come from the repository workflow. The uploader account can be a bot. A bot uploader is not a third-party mirror.
Pages that are not the project
lichiiemulator.net has called itself the official download host. The Lichii README does not link it. I do not list it as a source of files.
lichiiemulator.com and lichiiemulator.app are other guides. When I checked, both were still describing build 88. They are not the release channel.
An Android store page that lists a proprietary license is a different argument, covered on the Android page. Do not treat that package as the desktop build.
I treat these as warning signs: an APK or a cloud player sold as the desktop app, a bundle of keys or "all games included", a survey wall, a single setup.exe, a file size far from the table, or a chat link that leaves GitHub. Donations, if you make them, should match the addresses in the README, not a copy on another site.
FAQ
Is the code signed?
No notarization is published for the macOS app, and I have not seen a Windows signature claim in the release notes.
Which hash do I trust?
The digest on the GitHub release. The copy on this site is dated 7 Nov 2026.
Can antivirus be wrong?
Yes. A hash match tells you the bytes match the release. It does not tell you every scanner will be quiet.
Sources
Checked 2026-11-07.