Yes, itch.io itself is a legitimate platform—but no, every game or file hosted on it is not automatically safe. itch.io is a self-publishing marketplace and file-hosting service, so the security of a download depends on the specific creator, file, delivery method, and permissions it requests. Browsing an itch.io page is generally safe; running unfamiliar software is the point at which the risk begins.
The safest approach is to treat itch.io like any open publishing platform: prefer reputable creators and browser-based games, avoid unexpected downloads sent through Discord or other messages, keep your operating system protected, and use the itch.io app sandbox where it is compatible.
As an Amazon Associate I earn from qualifying purchases.
What itch.io does—and does not—guarantee
itch.io is operated by Itch Corp. It lets publishers upload and distribute games, software, books, soundtracks, and other digital content. Unlike a tightly curated console store, it is designed around self-publishing: creators can publish projects directly and users can download them.
Recommended Free Tools
That model is valuable for indie developers, game-jam projects, demos, experimental games, and creators who might not fit traditional storefronts. It also means that “hosted on itch.io” is not a security certification. itch.io’s terms prohibit viruses and malicious code, but they do not promise that every uploaded file has been tested or verified safe. Its community rules also state that itch.io is not responsible for user-generated content or user behavior.
#1 Best Overall
- Compatible with Windows and Android.
- 1000Hz Polling Rate (for 2.4G and wired connection)
- Hall Effect joysticks and Hall triggers. Wear-resistant metal joystick rings.
- Extra R4/L4 bumpers. Custom button mapping without using software. Turbo function.
- Refined bumpers and D-pad. Light but tactile.
itch.io has explained that uploads receive server-side checks, but its own security warning says automated checks and human review are imperfect. In other words, the claim that itch.io scans every upload and therefore every download is safe is incorrect. The platform itself advises users to be suspicious of unfamiliar projects and untrusted software in its security warning.
Is browsing itch.io safe?
Viewing a normal itch.io page is substantially lower risk than downloading and executing a file. itch.io’s warning specifically distinguishes visiting a page from running untrusted software. A web page can still contain scams, misleading instructions, aggressive advertising, or malicious web content, so normal browser protections remain sensible, but simply opening a project page is not the same as installing a program.
The main risk is usually the file you are persuaded to download and run. A game can be legitimate, compromised after publication, mislabeled, or deliberately malicious. A professional-looking page, positive comments, an old account, or the fact that itch.io indexes the project does not prove that the executable is safe.
The most dangerous itch.io scam: “try my game”
One of the clearest warning patterns is an unsolicited request to test someone’s game. An attacker may contact you through Discord or another messaging service, send an itch.io link, and ask you to download or play an executable. The message may appear to come from someone you know if that person’s account has been compromised.
Reported consequences include stolen Discord accounts, browser compromise, theft of stored payment information, password theft, and the victim’s account being used to send the same scam to other contacts. If a friend suddenly asks you to run a game—particularly if the request is unusual, urgent, or accompanied by a strange download link—verify it through a separate channel before opening anything.
A real developer account can also be compromised. In a 2025 incident, itch.io said files associated with a compromised developer account had been replaced with a link to an .exe file. The link reportedly remained available for a little over an hour before removal. This illustrates why a previously trusted page is not an absolute guarantee: accounts and uploads can be changed.
Rank #2
- Supported Multi-Platform:Switch/Switch 2 (NO support wake-up function)/iOS/Android/Windows PC (Notice:Not compatible with Xbox, PlayStation or GeForce Now, For game platforms not mentioned, please consult customer service before buying）
- Connection modes:Wired/Bluetooth/Wireless Dongle(Connect to PC via Bluetooth : Select iOS (phone) mode, but it's not recommended; Dongle is more stable)
- 【Innovative Intelligent Interactive Screen】Manba One V2 wireless game controllers create a new era of controller screens; Equipped with a 2-inch display, no App & software needed, you can set the pc controller directly through the screen visualization, More convenient operation
- 【Micro Switch Button】Manba One wireless controller has Micro Switch Button and ALPS Bumper; The 6-axis gyroscope function makes switch games more immersive
- 【Customize Your Own Controller】The intelligent interactive screen allows you to easily set vibrations, buttons, joysticks,lights, etc., without the need for complex key combinations; 4 configurations can be saved to unlock your own gameplay for different games; The 4 back keys support macro definition settings, and you can activate the set character's ultimate move with one click
Red flags before downloading
- An unsolicited message: You were contacted on Discord, social media, or email and pressured to “test” a game.
- A suspiciously urgent request: The sender insists you run it immediately or claims the build will disappear.
- An unexplained executable: You expected a game archive or browser game but received a standalone
.exe, script, installer, or shortcut without a clear reason. - A password-protected archive: Password protection is not proof of malware, but it prevents easy inspection and should raise your caution level when the source is unfamiliar.
- A demand for administrator access: A game asking to run as administrator is not automatically malicious, but it gives the program more power than a normal game should usually need.
- Inconsistent project information: The creator name, screenshots, download description, file name, and contact message do not match.
- Unexpected external links: The page redirects you to a different file host or asks you to disable security software.
None of these signs alone proves that a file is malicious. Together, especially when combined with social pressure, they are good reasons not to run the download.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Safer ways to use itch.io
- Choose the right format. If a game has an HTML5 or browser-playable version, it is generally a lower-risk choice than downloading native software. Browser games still depend on browser security and can contain malicious web content, but they avoid installing an unfamiliar executable on your computer.
- Research the creator within the page. Look for a consistent publisher identity, meaningful documentation, update history, and a download that matches the project description. These are useful signals, not guarantees.
- Do not trust the message alone. If a link arrived from a friend, confirm that they actually sent it using another communication method.
- Keep security controls enabled. Do not disable antivirus, SmartScreen, Gatekeeper, or similar protections just to launch a game. A warning is information—not an obstacle to bypass automatically.
- Use a separate environment for genuinely untrusted software. A spare computer or properly configured virtual machine can reduce exposure, but it is not a substitute for understanding what the program does.
- Back up important files. Backups help with data loss and ransomware, although they do not prevent credential theft.
- Use unique passwords and two-factor authentication. This is particularly important if you use the itch.io app, Discord, a browser with saved credentials, or payment accounts on the same device.
What the itch.io app sandbox actually does
The itch.io desktop app can sandbox games. The purpose is to restrict what a game can read and write, adding containment around the game process. It is useful protection, but it is not a malware detector and not a complete security boundary.
itch.io’s documentation says the sandbox does not protect you if you voluntarily give an attacker a password, voluntarily run untrusted software outside the sandbox, or encounter a vulnerability in a graphics driver. A sandboxed game may also retain meaningful access to system functions depending on the operating system and configuration.
Windows
On Windows, sandboxed games run as a separate, less-privileged user. The one-time setup creates an account named itch-player using:
net user itch-player salt /add
net localgroup Users itch-player /deleteSandboxed saves are stored under:
C:Usersitch-playerThat means a new C:Usersitch-player directory is expected behavior, not evidence that malware has been installed. Existing saves may remain in your normal profile, such as C:Usersyourself, while the sandboxed game looks under the new profile. For example, a Unity save could move conceptually from:
C:UsersleafAppDataRoamingcom.unity.gameto:
C:Usersitch-playerAppDataRoamingcom.unity.gameIf you copy saves into the sandbox profile, the itch-player account may need full permission on the save folder. Changing sandbox settings does not delete saves, but the game may stop finding them automatically.
Rank #3
- Tri-mode Connectivity: Wired for Xbox, 2.4G & Wired for PC, and Bluetooth for Android. The G7 Pro supports seamless connectivity across Xbox, PC, and Android. Effortlessly switch between modes using the convenient physical mode switch.
- TMR Sticks: The G7 Pro features GameSir's Mag-Res TMR sticks, combining Hall Effect durability with traditional potentiometer performance. This advanced technology delivers stable polling rates for smooth, drift-free gaming with low power consumption.
- Hall Effect Analog Triggers: The GameSir precision-tuned Hall Effect analog triggers provide unmatched smoothness and linear input for precise control. Featuring clicky Micro Switch trigger stops, gamers can easily switch based on their preferences.
- 1000Hz Polling Rate on PC: Experience ultra-responsive gaming with a 1000Hz polling rate on PC, available through both wired and 2.4G wireless connections. This ensures instantaneous input registration, reducing lag and optimizing your performance for the most competitive gameplay.
- GameSir Nexus App: The G7 Pro is compatible with the upgraded GameSir Nexus app, which brings a significant upgrade over the original. It introduces powerful new features such as gyro settings, stick curve adjustments, and button-to-mouse mapping, giving you deeper customization and more control than ever before.
macOS
The macOS app uses Apple’s sandbox-exec facility and generates a policy file at:
{install_folder}/.itch/isolate-app.sbThe available policy modes are:
- Balanced: the default hardened profile.
- Legacy: broader permissions for compatibility with older games.
In the app preferences, the relevant settings are Enable itch.io sandbox, Disable network access in sandbox, Policy mode, and Allowed environment variable names. Network access is allowed by default; selecting Disable network access in sandbox blocks it for sandboxed games.
The macOS policy blocks access to several credential-related locations, including:
~/Library/Application Support/itch~/Library/Application Support/kitch~/Library/Application Support/Google~/Library/Application Support/Mozilla
However, the sandbox still permits process forking and execution, Mach IPC, system sockets, IOKit access, and network access unless networking is disabled. Therefore, “sandboxed” does not mean “unable to perform system or network activity.”
If a legitimate game fails under Balanced mode, itch.io documents changing Policy mode to Legacy as a compatibility workaround. For troubleshooting, open Console.app, search for sandboxd denial messages, try Legacy mode, and inspect the generated policy file before reporting the problem.
Linux
Linux sandbox mode Auto selects a backend in this order:
Rank #4
- Multi-Platform PC Gaming Controller: Working with Switch, PC, Android, and iOS devices via Bluetooth, wired, and wireless dongle connections.
- Hall Effect Joysticks: Delivering enhanced recentering performance for smoother control and superior anti-drift capability. Plus, with anti-friction rings.
- 2-Way Trigger Lock: With trigger stops, gamers can toggle between short and long pull positions. Additionally, gamers can activate hair trigger mode by pressing M+LT/RT (triggers must be in the long pull position).
- 1000Hz Polling Rate: This ensures that your inputs are registered almost instantaneously, minimizing lag and maximizing your performance during competitive play.
- Mechanical Circular D-pad: Designed for quick reactions and accuracy in every direction, this D-pad elevates your gaming experience with superior responsiveness.
- Flatpak-spawn when the app is running inside Flatpak;
- Bubblewrap when
bwrapis available; - Firejail, using a system installation or downloading its own copy.
Bubblewrap is the preferred backend in the current itch.io documentation. It uses Linux namespaces and stores a game’s persistent home directory at:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall{install_folder}/.itch/homeTemporary files are stored at:
{install_folder}/.itch/tempThe temporary directory is cleaned after the game exits.
Firejail behaves differently: it does not redirect $HOME, so games write to the real home directory subject to blacklisted sensitive paths. Switching between Bubblewrap and Firejail can make saves appear to disappear because the two backends use different locations. itch.io describes Firejail as generally not recommended because its compatibility-oriented blacklist allows broader filesystem access than Bubblewrap’s explicit-mount approach.
If the app downloads its own Firejail copy, it may ask for a password once to set the SUID bit. Sandboxed games themselves do not run with root privileges.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Protect your itch.io account
Account security matters because an attacker who takes over your account may impersonate you, alter projects, or use your identity to distribute malicious links. itch.io supports TOTP-based two-factor authentication, not SMS-based two-factor authentication.
Free tools Windows power users keep installed
One-click scans. No signup required.
To enable it, go to User settings → Security, scan the displayed QR code with a compatible authenticator app, and enter the rotating six-digit code. The code changes every 30 seconds. Activation also generates eight-digit recovery codes; store them somewhere safe. Losing your authenticator device without those codes can lock you out.
Best Value
- Platform Compatibility: This PC controller is designed for Windows PC, Steam, Switch, Android, and iOS. Xbox-style asymmetric stick layout for PC gamers. Three modes cover all your devices. Please check your device compatibility before purchase
- Three Connection Modes: 2.4G wireless, Bluetooth, wired USB-C. PC gets native XInput/DirectInput. Switch pairs via Bluetooth, no adapter. This gaming PC controller switches devices seamlessly. Stable wireless minimizes random disconnects during gaming
- Hall Effect Precision: Hall effect joysticks and triggers eliminate stick drift. This gaming controller for PC delivers smooth, responsive input with no dead zones. Built for FPS, racing, and action games. Long-term precision for competitive PC gaming
- Back Buttons & Battery: Two programmable back buttons map combos and shortcuts. Textured grips with dual vibration. 1000mAh battery delivers up to 20H playtime. RGB can be turned off. A solid PC controller for gaming with custom back buttons
- ABXY Layout Switch: Press B + Minus + Plus to swap between PC and Switch modes. Features: 1000Hz polling rate, RGB lighting, turbo. Note: designed without mic jack or gyro sensor
If a valid code is rejected, check that your phone uses network-based automatic time adjustment. A clock mismatch between the phone and server can cause TOTP failures.
What to do if you already ran a suspicious file
- Disconnect the device from the internet if you suspect active compromise. This can limit communication with an attacker, though it may also interrupt legitimate security tools.
- Stop using the affected device for sensitive logins. Use a separate, trusted device to change passwords.
- Change passwords for important accounts, prioritizing email, Discord, password managers, banking, payment services, and itch.io. Use unique passwords and enable TOTP where available.
- Revoke active sessions and tokens where the service provides that option. This is especially important for Discord and email.
- Run current security scans and install operating-system and browser updates. If the file requested administrator access or you see signs of system compromise, consider professional incident-response help or a clean operating-system reinstall.
- Warn your contacts if your account may have sent suspicious messages.
- Report the project, post, or account. For unwanted community content, use the
reportbutton below the post. Account issues can be sent to itch.io support from the email address that owns the account.
Do not assume that deleting the downloaded file reverses credential theft. If you typed a password into a suspicious program or web page, treat that password as exposed.
Reporting, support, and refunds
Use the report button below an unwanted community post. A moderator can review it, remove offending content, and ban users from the relevant community through the report process.
For account problems, contact [email protected] from the email address associated with the account. itch.io sends a receipt containing a Ticket ID; include that ID in later messages.
itch.io does not provide support for the individual games on its marketplace. For a game-specific problem, use the game page or purchase page and look for the developer’s contact information.
Under itch.io’s terms, a refund may be requested when purchased content cannot run, access is blocked, or the product does not accurately represent what was advertised. For technical problems, itch.io may direct you to contact the publisher first. Refund requests go through support with purchase information. Refunds involving third-party keys, such as Steam keys, may require the publisher to confirm cancellation because itch.io may not be able to disable an external key.
Common myths, corrected
| Claim | What is actually true |
|---|---|
| “Everything on itch.io is safe because it is scanned.” | Server-side checks exist, but itch.io says automated checks and human review are imperfect. Downloaded software is not guaranteed safe. |
| “An old account proves the uploader is trustworthy.” | Account age is not a security certification, and an established account can be compromised. |
| “The app sandbox makes every game safe.” | It reduces selected attack surfaces but does not prevent all attacks, voluntary credential disclosure, or graphics-driver vulnerabilities. |
| “The app always stores saves in the normal profile.” | Save locations vary: Windows uses itch-player, Bubblewrap uses .itch/home, and Firejail uses the real home directory. |
| “itch.io supports SMS 2FA.” | Current documentation supports TOTP and says SMS 2FA will not be added. |
The Bottom Line
Bottom line: itch.io is safe to browse and can be safe to use, but it is not a guarantee that every uploaded game is safe to run. Treat unexpected executables as high risk, verify unusual requests independently, keep security protections enabled, use two-factor authentication, and enable the itch.io sandbox when its limitations and compatibility trade-offs are acceptable.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches
