Windows installation guide

Download the right package for your computer

Open the Hangrail download section. In mainland China, try Gitee first and use the GitHub mirror if the connection is poor. Choose x64 for standard Intel/AMD computers or ARM64 for Windows ARM computers. Check “System type” in “Settings → System → About” to confirm.

For first installation, choose your architecture's Setup.zip. After fully extracting it, the folder should contain an installer whose name ends in -Setup.exe together with the Hangrail-Development.cer public certificate, and Windows-INSTALL.txt instructions. Keep these files, verify the certificate first, then run the installer.

Verify the development certificate

Double-click Hangrail-Development.cer to view the certificate. Under “Details,” check its subject and fingerprint. The current fixed identity is:

To check the CER file digest, open PowerShell in the extracted folder and run Get-FileHash .\Hangrail-Development.cer -Algorithm SHA256 to verify the result. Letter case does not affect comparison. The download section's “Release notes” includes this version's SHA256SUMS.txt. Replace the filename in the command with the full path to the downloaded ZIP to check the package digest. A certificate digest does not replace a package digest.

Matching names do not mean matching certificates. If any digest or fingerprint differs, stop installation and check the source again in the official download section.

Decide whether to trust the publisher

Continue only after confirming the source and certificate match and that you wish to trust this publisher:

1. Double-click the public CER and click “Install Certificate.”
2. Choose “Local Machine” as the store location and confirm administrator access when prompted.
3. Select “Place all certificates in the following store,” browse, and choose “Trusted People.”
4. Confirm the chosen store, complete the import, then run the -Setup.exe installer in the same folder.

Do not choose “Trusted Root Certification Authorities.” Importing into “Local Machine → Trusted People” makes this computer trust packages signed with this certificate. Its effect extends beyond this one downloaded file and applies to other users on the computer. This does not mean Microsoft or a public certificate authority endorses the certificate. The installer itself does not import certificates or change system trust.

Installer and runtimes

If Hangrail is running, save your notes and quit normally from the tray menu. Open the installer and click “Install Hangrail” (安装 Hangrail). The installer checks for the matching .NET Desktop Runtime. If missing, it downloads it from Microsoft, verifies its digest and Microsoft digital signature, then guides you through installation. Administrator confirmation may appear. You do not need the .NET SDK.

If the network fails or installation is canceled, retry later. If runtime installation requires a restart, restart the computer and run the Hangrail installer again. Installing the minimal MSIX directly does not prepare runtimes automatically, so Setup is recommended for first installation.

SmartScreen prompts

If a “Windows protected your PC” prompt says an unrecognized app was blocked, first check the filename, download source, and package digest. Proceed only if you are sure you trust this installer: click “More info,” review the details, and choose “Run anyway” if available. This confirms this run only; you do not need to turn off SmartScreen. See Microsoft's first distribution guide.

If malware is detected, the certificate differs, or system policy offers no way to continue, stop installation and report it. Do not turn off protection or add exclusions to run it.

Updates and installation blocks

Ordinary updates preserve your library, groups, and settings. For important content, first make an independent backup. In an installed version, check “Settings → Update” (设置 → 更新), or quit normally and upgrade using the installer from the website.

For a security block, first check the download source, architecture, signature, and certificate trust. Organization-managed computers may also have installation policies. Installation does not require turning off Defender, disabling signature checks, or enabling test mode. If still unsure, send the error details to Hangrail support.

For Microsoft's MSIX signing and trust requirements, see Signing overview and MSIX signing guide.