It was the most frequent question in the messages received since the Windows app came out: “why does Windows say the publisher is unknown?”. Starting with version 1.8.0, available today, the answer changes: the Correctify installer is digitally signed and timestamped. Here is what that means in practice, without jargon, and what you should now see on your screen.
A digital signature is a modern wax seal
Important letters used to be closed with a wax seal stamped with the sender’s crest. The recipient then knew two things: who had sent the letter, and that it had not been opened on the way. A digital signature does exactly the same for a program.
A code-signing certificate is issued by a certificate authority after verifying the identity of the person requesting it. With that certificate, the publisher applies a mathematical signature to the program that depends on every byte of the file. Windows checks it when the file is opened: if a single bit was changed after signing, the signature becomes invalid and Windows says so. If it is valid, Windows shows the publisher’s name, as verified by the authority.
What changes for you
1. Windows shows a publisher, no longer “Unknown publisher”. In the User Account Control window that opens when you launch the installer, the Publisher line now shows a name starting with “Open Source Developer”, followed by the project author’s name, the one you will find on the open source page. If you see that, the file really comes from here and has not been altered.
2. Automatic updates are verified. The app updates itself in the background. Since 1.8.0, it checks that every downloaded update carries the same signature before installing it. An update whose signature does not match is rejected. That is an extra safeguard against a file being swapped along the way.
3. The download should no longer be blocked by your browser. Chrome and a few others sometimes refused to save the installer with a “dangerous file” message, purely because it was unsigned. A signed executable normally no longer triggers that block. The .zip version, which served as a workaround, is still offered under the download button for stubborn cases.
4. The signature is timestamped. An independent timestamping service certifies the date of each signature. As a result, it stays valid even after the certificate expires, which happens yearly. An installer downloaded today will still be recognised as signed two years from now.
How this signature was obtained
Correctify is a free project, with no ads and no subscription, and a regular code-signing certificate costs several hundred euros a year. That is why the app was not signed until now, and I had explained it plainly.
What unlocked the situation was releasing the app’s code as open source, under the MIT licence. The certificate authority Certum offers an “Open Source Developer” certificate, reserved for projects whose code is public, for about thirty euros a year. The process is anything but automatic: the authority verified the author’s identity against an official ID, as well as the link between that identity and the code repository, before issuing the certificate.
One detail that matters for security: the key used to sign is not stored on any computer. It lives in a secure module at the certificate authority, and the signing session only opens with a one-time code generated on the author’s phone at build time. Even if the build machine were compromised, nobody could sign a program in their place.
Let’s be honest: SmartScreen may still show up for a while
Signing does not make the blue “Windows protected your PC” screen vanish overnight. SmartScreen assesses a reputation, and that reputation is now attached to the certificate, not only to the file. A brand-new certificate starts from zero: during the first few weeks the warning may still appear, then it fades as installations accumulate.
The difference from before matters: this reputation no longer resets with every new version. Each update signed with the same certificate inherits it. And if the screen does appear, you now have a simple way to check: click “More info” and read the Publisher line. It must start with “Open Source Developer”. If it says “Unknown publisher”, that is not the 1.8.0 downloaded from the official site: do not install it.
Verify the signature yourself, in thirty seconds
Right-click the downloaded file, choose “Properties,” then the “Digital Signatures” tab. You will see the signer’s name and, by clicking “Details,” the message “This digital signature is OK” along with the timestamp. If you prefer PowerShell, one line is enough:
Get-AuthenticodeSignature "$env:USERPROFILE\Downloads\Correctify Setup *.exe" | Format-List Status, SignerCertificate
The Status field must be Valid. The Security section of the Windows page lists the exact signer name, and still publishes the VirusTotal report and the installer’s SHA-256 hash: the signature adds to those checks, it does not replace them.
What does not change
Everything else. Correctify remains free, with no account and no subscription. You still use your own API key with the AI provider of your choice, and your text goes straight to them, with no intermediate server. The code remains public and readable by anyone. The signature adds a guarantee about where the file comes from; it changes neither how the app works nor what it does with your data.
How to move to 1.8.0
If you already have Correctify, there is nothing to do: the app updates itself in the background and lets you know once the new version is installed. This is the last update installed without a signature check, since the previous version did not know how to perform one yet; all the following ones will be verified.
If you are discovering the app, head to the download page. And if you don’t have an API key yet, our step-by-step guide gets you one in a few minutes.