← Back to Kayra

Security & Installation

Honest answers about the Kayra Windows installer, in plain language.

If Windows or Chrome showed you a warning when downloading KayraSetup.exe, that is expected right now, and this page explains exactly why — and how you can verify the file yourself instead of just trusting this text.

Why the warning happens

KayraSetup.exe is not yet digitally signed. Windows and Chrome both treat new, unsigned software with default caution — this is a reputation-based warning, not a report of a specific detected threat. It appears for many small/new pieces of software, signed or not always immediately trusted, purely because the publisher has no established track record yet with Microsoft/Google's reputation systems.

We have not used a self-signed certificate to make this warning disappear artificially — a self-signed certificate does not establish real publisher identity and would not actually mean anything more trustworthy than what you see today. When we are able to obtain a real, certificate-authority-issued code-signing certificate, this installer will be signed with it and this warning should go away on its own.

How to verify the file yourself

Kayra is built from source you can read. Every published download's SHA-256 checksum is shown below — compute the checksum of the file you downloaded and compare it. If it matches, you have the exact file we built and published, unmodified in transit.

On Windows, in PowerShell:

Get-FileHash .\KayraSetup.exe -Algorithm SHA256

Then compare the result against the current published checksum:

KayraSetup.exe SHA-256loading…

What we do NOT ask you to do

If you're not comfortable proceeding past a warning, that's a completely reasonable choice — wait until the installer is signed, or verify the checksum above yourself first.

What Kayra actually installs

KayraSetup.exe installs the Kayra desktop agent (a background service that connects your PC to your Kayra account over an encrypted, authenticated connection), a system tray icon, and an optional wake-word listener. Everything it does is visible, real, plain-language source code — there is no hidden functionality.