Is RetroBar safe?

#What we checked

Scan output and file hashes: results.json (look for defender and files). Hashes are also on the download page.

#What RetroBar does on your PC

• Hides the Windows taskbar and draws its own. It switches the Windows taskbar to auto-hide and hides it while running, and restores your setting when you exit. This is the reason some antivirus programs find it suspicious: hiding the taskbar is unusual behaviour.
• Shows your open windows and notification icons. It reads the list of open windows and the icons apps put in the notification area, as any taskbar must.
• Saves its settings in %LOCALAPPDATA%\RetroBar\settings.json and logs in %LOCALAPPDATA%\RetroBar\Logs.
• Starts at sign-in only if you ask it to, through the normal Windows startup list.
• Takes over the Win+number hotkeys only if you choose that in Properties; it warns you first.

It installs no service, driver or browser extension, and it does not change Windows system files.

#Does RetroBar connect to the internet?

Only to check for updates, and you can turn that off. RetroBar's source has one piece of network code (Updater.cs). Ten seconds after it starts, and then once a day, it downloads a tiny file, https://dremin.github.io/updates/retrobar.json, which contains only the latest version number. If a newer version exists, an “Update available” item appears in its right-click menu; clicking it opens the GitHub releases page. RetroBar never downloads or installs anything by itself. Nothing about you or your PC is sent, beyond what any web request includes (your IP address).

In our tests we listed RetroBar's network connections a few seconds after it started. On two of the three machines there was exactly one, to a GitHub Pages server (185.199.108.153, port 443) where that file lives; on the third, none yet. To turn the check off: Properties › Taskbar › untick Check for updates.

The installer makes the same version check when it starts, and downloads the .NET runtime from Microsoft if you need it.

#Why Windows warns about it

RetroBar's files are not signed. Windows SmartScreen shows “Windows protected your PC” for unsigned programs that it has not seen many times, and browsers sometimes flag such downloads too. To continue, click More info, check that the app is RetroBarInstaller.exe, then Run anyway. Only do that with a file you downloaded from the official GitHub page, and ideally after checking its SHA-256 hash.

#What about VirusTotal?

VirusTotal runs a file through about seventy antivirus engines. For a program that changes how Windows looks and is not signed, one or two of them flagging it is common; these are usually generic, “suspicious behaviour” detections rather than a known threat. Check the engine names and how many flag it: when the big engines (Microsoft, Kaspersky, ESET, Bitdefender and similar) are clean, it is very likely a false alarm.

#Copies to avoid

The real risk is a modified copy. RetroBar is distributed only through its GitHub releases page (and winget, which downloads from there). Download sites that re-host it may be out of date or wrap it in their own installer, and websites using the RetroBar name, including this one, are not the RetroBar project. Our download page links straight to GitHub and lists the hashes of the official files.

#Questions

Found something out of date or wrong? Tell us at hello@retrobar.dev and we will fix it.