Free tools Windows power users keep installed
One-click scans. No signup required.
Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Itch.io is a legitimate platform, but a game or file hosted there is not automatically safe. Itch.io is a self-publishing marketplace: creators upload their own content, and the platform says its automated checks and human review cannot guarantee every download is safe. Browsing a project page is different from running a file on your computer. Treat unfamiliar downloads with caution, especially when someone pressures you to test a game outside a trusted context.
What itch.io’s safety guarantees do—and don’t—mean
Itch.io is a website, desktop app and distribution platform for software and media. Its terms prohibit publishers from uploading viruses or malicious code, but that rule is not the same as verifying every file. The platform’s terms put responsibility for uploaded content on publishers, and its community rules say itch.io is not responsible for user-generated content or user behavior.
Itch.io warns that viewing a page is safe, while downloading untrusted software is not. Anyone can publish a project page, and checks by automated systems and people are imperfect. Server-side checks do exist, but they are not a safety certificate. A polished page, an old account or a project indexed on itch.io does not prove its files are harmless. See the platform’s security warning and staff discussion of upload checks.
Recommended Free Tools
Which downloads deserve the most caution?
Unexpected requests to “try my game”
A known scam starts with a message on Discord or another platform asking you to test a game. The file may be hosted on itch.io or elsewhere. A friend’s account may have been compromised, so verify unusual requests with that person through a separate, trusted channel before downloading anything. Itch.io has documented reports of attackers seeking Discord access, browser data, saved payment information and passwords, then using a victim’s account to target more contacts.
#1 Best Overall
- With broad game support, the Logitech Gamepad F310 works with old standbys to today's biggest titles, so it's easy to set up and use with your favorite games.
- Profiler software allows the gamepad to be programmed to perform keyboard and mouse commands for games without gamepad support.* * Requires software installation.
- A familiar control layout that doesn't require a learning curve to be able to use, with all the same buttons as on an Xbox 360.
- The unique floating D-pad rests on four switches-instead of a single pivot point-making it responsive to quick changes in direction.
- The six-foot cord lets you lean back and play a comfortable distance from your PC monitor.
Executable files, password-protected archives and urgent instructions
A password-protected archive, unexplained executable or demand to run a game as administrator is not proof of malware on its own, but each is a reason to stop and verify the source. Do not disable security protections or grant elevated permissions just because a page or message tells you to. Itch.io documented a 2025 incident in which a compromised developer account’s legitimate game files were replaced with a link to an .exe; the link reportedly remained available for a little over an hour before removal. The incident shows that even an established project can be affected if its account is compromised. Community reports of red flags are collected in this itch.io discussion.
Browser games versus downloaded games
HTML5 games run in the browser sandbox by default, making them a lower-risk option than downloading and running native software. That does not eliminate browser vulnerabilities or risks from malicious web content, but it avoids installing an unfamiliar executable. Itch.io’s warning distinguishes browser play from downloading untrusted files.
Rank #2
- Compatible with Windows and Android.
- 1000Hz Polling Rate (for 2.4G and wired connection)
- Hall Effect joysticks and Hall triggers. Wear-resistant metal joystick rings.
- Extra R4/L4 bumpers. Custom button mapping without using software. Turbo function.
- Refined bumpers and D-pad. Light but tactile.
What the itch.io app sandbox protects—and what it cannot
The itch.io app can run games in a sandbox that restricts some file access. On Windows, games run under a separate, less-privileged itch-player account; on Linux, some backends provide a separate per-game home directory. This is containment, not malware detection or a complete security boundary. It does not protect you if you voluntarily give an attacker your password, run untrusted software outside the sandbox, or encounter a graphics-driver vulnerability. Details and limitations are in the sandbox documentation.
Windows
One-time setup creates a local account named itch-player. Itch.io documents these commands:
Rank #3
- Multi-Platform PC Gaming Controller: Working with Switch, PC, Android, and iOS devices via Bluetooth, wired, and wireless dongle connections.
- Hall Effect Joysticks: Delivering enhanced recentering performance for smoother control and superior anti-drift capability. Plus, with anti-friction rings.
- 2-Way Trigger Lock: With trigger stops, gamers can toggle between short and long pull positions. Additionally, gamers can activate hair trigger mode by pressing M+LT/RT (triggers must be in the long pull position).
- 1000Hz Polling Rate: This ensures that your inputs are registered almost instantaneously, minimizing lag and maximizing your performance during competitive play.
- Mechanical Circular D-pad: Designed for quick reactions and accuracy in every direction, this D-pad elevates your gaming experience with superior responsiveness.
net user itch-player salt /add
net localgroup Users itch-player /deleteSandboxed games use C:Usersitch-player for saves and other profile data. Existing saves may remain in the original profile, such as C:Usersyourself, so a game may appear to have lost its progress after sandboxing is enabled. For example, itch.io shows a Unity save moving from C:UsersleafAppDataRoamingcom.unity.game to C:Usersitch-playerAppDataRoamingcom.unity.game. Copying saves into the sandbox profile may require granting itch-player access to the folder through Windows Explorer’s folder permissions. The new C:Usersitch-player directory is expected when this sandbox is used, not evidence by itself that malware was installed. See the Windows instructions.
macOS
The macOS app uses Apple’s sandbox-exec facility and generates a policy at {install_folder}/.itch/isolate-app.sb each time a game launches. In the app preferences, the settings are Enable itch.io sandbox, Disable network access in sandbox, Policy mode and Allowed environment variable names. The default Balanced policy is more restrictive; Legacy allows broader permissions for compatibility with older games.
Rank #4
- Supported Multi-Platform:Switch/Switch 2 (NO support wake-up function)/iOS/Android/Windows PC (Notice:Not compatible with Xbox, PlayStation or GeForce Now, For game platforms not mentioned, please consult customer service before buying）
- Connection modes:Wired/Bluetooth/Wireless Dongle(Connect to PC via Bluetooth : Select iOS (phone) mode, but it's not recommended; Dongle is more stable)
- 【Innovative Intelligent Interactive Screen】Manba One V2 wireless game controllers create a new era of controller screens; Equipped with a 2-inch display, no App & software needed, you can set the pc controller directly through the screen visualization, More convenient operation
- 【Micro Switch Button】Manba One wireless controller has Micro Switch Button and ALPS Bumper; The 6-axis gyroscope function makes switch games more immersive
- 【Customize Your Own Controller】The intelligent interactive screen allows you to easily set vibrations, buttons, joysticks,lights, etc., without the need for complex key combinations; 4 configurations can be saved to unlock your own gameplay for different games; The 4 back keys support macro definition settings, and you can activate the set character's ultimate move with one click
Network access is allowed by default; selecting Disable network access in sandbox blocks it for sandboxed games. The policy blocks access to several credential-related locations—~/Library/Application Support/itch, ~/Library/Application Support/kitch, ~/Library/Application Support/Google and ~/Library/Application Support/Mozilla—but still allows process forking and execution, Mach IPC, system sockets and IOKit access. A sandboxed game can therefore still perform some system activity, and can use the network unless you disable access.
If a game fails under Balanced, itch.io documents switching Policy mode to Legacy as a compatibility workaround. To diagnose a sandbox failure, open Console.app and look for sandboxd denial messages; if needed, inspect the policy file and report the Console output and policy contents. See the macOS sandbox documentation.
Best Value
- Wide Compatibility: VOYEE wired 360 controller compatible with Microsoft Xbox 360 & Slim/ PC (Windows 11/10/8.1/8/7). Just plug and play, not for FPS games
- Enhanced Game Controller: Upgraded PC 360 controller with new left and right trigger buttons and more sensitive joysticks and buttons - Respond quickly to player commands without delay
- Astonishing Gaming Experience: VOYEE wired pc controller provides rumble control and according to the game automatic vibration feedback to enhanced game experience and match your personal preference
- Ergonomic Design: Grips's contours have been designed to fit your hands more comfortably to hold for a long time and 7.2ft cord allows greater
- What You Get: VOYEE wired 360/PC Controller, 45 Days Money Back, 365 Days Guarantee Against quality defect and 24 Hours Friendly Customer Support
Linux
With sandbox type Auto, the app chooses Flatpak-spawn when running inside Flatpak, then Bubblewrap if bwrap is available, then Firejail. Itch.io currently prefers Bubblewrap, which uses Linux namespaces to isolate games. Its persistent home is {install_folder}/.itch/home; its temporary directory, {install_folder}/.itch/temp, is cleaned when the game exits.
Firejail behaves differently: it does not redirect $HOME, so games write to the real home directory, subject to blacklisted sensitive paths. Itch.io describes Firejail as generally not recommended because its compatibility-oriented blacklist permits broader filesystem access than Bubblewrap’s explicit mounts. Changing between Bubblewrap and Firejail can make saves seem to disappear because the backends use different locations. If the app downloads its own Firejail copy, it asks for a password once to set the SUID bit; games launched through it do not run as root. Consult the Linux documentation for backend details.
Practical steps before and after downloading
- Be skeptical of unsolicited testing requests, even if they appear to come from someone you know. Confirm unusual messages independently.
- Prefer browser-playable HTML5 games when that works for you; avoid running unfamiliar executables simply to find out what they do.
- Do not provide account passwords, disable protections or grant administrator privileges at a stranger’s request.
- Use the itch.io app sandbox as an additional restriction where available, but do not treat it as proof that a game is safe.
- If you enable sandboxing, keep in mind that save files can move to a different profile or directory. Check the relevant operating-system documentation before concluding that progress is gone.
Protect your itch.io account
Enable TOTP two-factor authentication at User settings → Security. Setup requires scanning a QR code with a supported authenticator app. Afterward, signing in requires your password and a six-digit code that changes every 30 seconds. Itch.io does not support SMS-based two-factor authentication and says it will not add it.
Save the eight-digit recovery codes somewhere separate from your authenticator device: losing the device without the codes can lock you out. If a valid code is rejected, check that your phone’s network-based automatic time adjustment is enabled; a clock mismatch can cause failures. Follow itch.io’s two-factor authentication guide.
Reporting scams, account problems and game issues
- Unwanted community post: Use the
reportbutton below the post. A moderator can review it, delete offending content or ban users from the community through the report dialog. See the community rules. - Account issue: Email [email protected] from an email address associated with the account. Keep the receipt’s Ticket ID for any follow-up. The contact requirements are on itch.io Support.
- Problem with a particular game: Itch.io does not provide support for individual marketplace games. Check the game or purchase page for the developer’s contact details.
Purchases and refunds
Itch.io’s terms say you may request a refund if purchased content cannot run, access is blocked or the product does not accurately represent what was advertised. For technical problems, itch.io may direct you to contact the publisher first. Submit refund requests to itch.io support with your purchase information. Refunds involving third-party keys, such as Steam keys, may require the publisher to confirm cancellation because itch.io may not be able to disable an external key. Payments can be processed through itch.io or providers including PayPal, Stripe and Payoneer. See the terms.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
