The short answer, without absolutes
SageThumbs is a long-standing open-source project whose source code anyone can inspect, distributed through SourceForge, and the genuine installer can be verified exactly by its cryptographic hashes. Those are checkable facts, and they are the right basis for a safety judgement. What no honest page can tell you is that any piece of software is completely, permanently safe in every circumstance, so this page sticks to what can be verified: where SageThumbs comes from, how to confirm your copy is the real file, and what the remaining caveats are.
Who makes SageThumbs and where it officially lives
SageThumbs is written by Nikolay Raspopov, who publishes it under the name Cherubic Software. The official project home is on SourceForge, the developer’s own site is cherubicsoft.com, and the source code is hosted in the SourceForge project repository. There is no official GitHub repository for the classic SageThumbs, so a GitHub page claiming to be the official release channel is a reason for caution, not confidence. The software is licensed under the GNU General Public License version 2 or later, which means the C++ source code is public and the program is free. Open source does not automatically make a program safe, but it does remove the biggest unknown: independent readers can check what the code does, and the project has been public since 2004.
Verify your download with the official hashes
The strongest check available to any user is a hash comparison, because it proves the file on your disk is byte-for-byte the file the project published. For the current release, SageThumbs 2.0.0.23 (9 May 2017), the official installer sagethumbs_2.0.0.23_setup.exe is 2,242,393 bytes, with these hashes:
- SHA-256: 705d743e28b487e34a4a7245a0dbc303a10e45ba0fd9e4da4101c8cdf506839a
- MD5: 2af65abf462c9b3170c6e80428f90888
- SHA-1: dd798c6ddc1fe523b0919c0d70c36b7932a67be5
These values match the metadata SourceForge itself records for the release. To check your copy on Windows 10 or 11, open PowerShell in the folder containing the file and run Get-FileHash on it, then compare the SHA-256 result character by character. If it differs, do not install the file; download again from the SourceForge project page. SourceForge also runs its own malware scan on hosted files, and its scan status for this release is recorded as OK, which is a useful second signal alongside your own hash check. Where you download from matters as much as what you download. Copies of the installer circulate through third-party file hosts and private file-sharing links, and a hash can only protect you if you actually compare it. If a site bundles the installer with a downloader program, offers a different file name, or asks you to disable your antivirus, close the page and use the official channel instead.
How SageThumbs behaves once installed
SageThumbs is a shell extension, not a background service. It has no standalone program window, nothing to launch, and no updater phoning home; its DLLs are loaded by Windows Explorer when you browse image files, and it keeps a thumbnail cache in a local database called sagethumbs.db3. It renders 162 image formats through the GFL Library, a well-known image library by Pierre-E Gougelet, the author of XnView. That architecture shapes the realistic risk picture. The main exposure with any shell extension is that it parses untrusted image files inside Explorer, and SageThumbs relies on an old library that has not been updated since the final release in 2017. No specific vulnerability is being claimed here, but unmaintained file-parsing code is a general reason to keep your expectations and your habits sensible: keep Windows itself updated, and be cautious with image files from untrusted sources, whatever thumbnail tool you use.
The honest caveats
First, the software is unmaintained. Version 2.0.0.23 from 2017 is the last release, and later project activity was limited to moving the source repository in 2024. If a problem were found tomorrow, there is no active team committed to fixing it. Second, the developer signs nothing with a commercial code-signing certificate, so Windows SmartScreen may warn on a fresh download simply because the file is unsigned and uncommon. A SmartScreen prompt is not proof that a file is malicious, but neither should you wave it through on a stranger’s say-so: verify the hash first, and only proceed when the hash matches the official values above and the file came from SourceForge. Third, beware of lookalikes. A separate modern project calling itself SageThumbs 2K appeared in 2026 as an independent rebuild under a different licence. It is not the classic SageThumbs and not an official successor, so do not mix up its files, claims or format counts with the original when you are deciding what to install.
A practical safety checklist
- Download from the SourceForge project or the link on cherubicsoft.com, not from file-sharing mirrors.
- Compare the SHA-256 hash of your file with 705d743e28b487e34a4a7245a0dbc303a10e45ba0fd9e4da4101c8cdf506839a before installing.
- Check the file size is 2,242,393 bytes and the version in Properties reads 2.0.0.23.
- Decline any bundled extras, download managers or requests to disable security software.
- Uninstall through Windows Settings or Control Panel if you ever want it gone; it removes like any normal program.
Frequently asked questions
Is SageThumbs open source?
Yes. SageThumbs is released under the GNU General Public License version 2 or later, and its source code is publicly hosted in the SourceForge project repository.
How can I be sure my SageThumbs installer is genuine?
Compare hashes. The genuine sagethumbs_2.0.0.23_setup.exe has SHA-256 705d743e28b487e34a4a7245a0dbc303a10e45ba0fd9e4da4101c8cdf506839a and is 2,242,393 bytes. A mismatch means the file is not the published release.
Why does Windows warn me about an unrecognised app?
The installer is not signed with a commercial certificate, so SmartScreen treats it as unknown. Verify the hash against the official values first; only continue when it matches exactly and the file came from SourceForge.
Related guides
- Understand the tool itself in What Is SageThumbs?
- Release background: SageThumbs Version History.
- Platform setup: SageThumbs on Windows 11.
- Download the official installer from the download page.