I install and update most of my apps with this Windows command now, and I stopped downloading sketchy installers

A few commands handle searching, installing, and updating most of what I run, and there's a graphical version if you would rather not touch a terminal.

VIEW GALLERY - 8

Yasir Mahmood

Guides Editor

Published Jul 18, 2026 11:50 AM CDT

4 minutes & 15 seconds read time

Voice: Yasir MahmoodSpeed

0:00 / 6:52

For a while now, I've installed and updated the software on my PC without opening a browser or visiting a single download page. It sounds like a power-user habit, but the tool behind it comes built into Windows and takes about three commands to learn. If you still hunt for installers by hand, I think it's worth the switch.

Winget is the package manager Windows should have had from the start

The tool is called winget, short for Windows Package Manager, and it's Microsoft's command-line installer. It has been part of Windows 11 for years now, distributed via the App Installer, so there is nothing to download or sign into before you can use it.

To check that it's ready, open Terminal, type winget and press Enter; if a list of commands appears, you're set. On the rare PC where it doesn't respond, updating App Installer from the Microsoft Store sorts it out.

I install and update most of my apps with this Windows command now, and I stopped downloading sketchy installers 01

VIEW GALLERY - 8 IMAGES

Anyone who has spent time on Linux will find the concept familiar, since this is Windows' version of package managers like apt and dnf that have handled software elsewhere for decades. You ask for a program by name, and the tool goes and fetches it.

A few commands do the work I used to spread across a dozen browser tabs

In practice, three commands cover almost everything I do. The first is search: running winget search chrome returns a tidy list of matches along with their exact package IDs, publishers, and versions, drawn from both the winget repository and the Microsoft Store. When I want more detail before committing, winget show prints the publisher, version, and description for a given ID.

I install and update most of my apps with this Windows command now, and I stopped downloading sketchy installers 02

I install and update most of my apps with this Windows command now, and I stopped downloading sketchy installers 03

Installing is a single line after that. Typing winget install Mozilla.Firefox downloads the file, runs the installer quietly in the background, and finishes without any wizard, checkbox, or bundled toolbar to decline along the way. The same pattern works for anything else in the repository, so Notepad++, VLC, or 7-Zip are each one command.

I install and update most of my apps with this Windows command now, and I stopped downloading sketchy installers 04

Updating is the part I would give up last. Rather than opening a dozen apps to check each one, I run winget upgrade to see what's outdated, then run winget upgrade --all to bring everything up to date in a single pass, adding --include-unknown when I want it to catch apps whose version it can't read.

Our Latest TweakTown Guides

I install and update most of my apps with this Windows command now, and I stopped downloading sketchy installers 05

I do all of this from an elevated Terminal, since running as administrator means I approve once rather than clearing a User Account Control prompt for every app. As always, the sensible rule is to install only software you trust.

Frequently Asked Questions

TweakBot answers common questions about this guide using TweakTown's own coverage from this page and related content from our archive. Tap a question to reveal the answer, or type your own below.

Question #1

How do I verify winget is installed and ready to use on my Windows PC?

Open Terminal, type winget and press Enter; if a list of commands appears, winget is installed and ready to use. If it does not respond, update App Installer from the Microsoft Store to sort it out.

Answered

Question #2

What exact winget commands does the article recommend for searching, installing, and showing package details?

The article recommends using winget search to find packages (example: winget search chrome), winget show to display a package's publisher, version, and description (example: winget show <packageID>), and winget install to install a package by ID (example: winget install Mozilla.Firefox).

Answered

Question #3

Why does the author prefer winget installs over downloading installers from ad-heavy portals?

The author prefers winget because it pulls the installer straight from the publisher's download URL or the Microsoft Store and checks each download against a stored SHA256 hash, refusing to run files that do not match. Packages also pass Microsoft SmartScreen checks and static analysis before entering the repository, which reduces the risk of tampered or repackaged installers. By contrast, ad-heavy download portals often wrap installers with junk, slip in adware, and use fake buttons that can lead to unwanted or unsafe software.

Answered

Question #4

Which apps or scenarios does the article say winget cannot handle (e.g., beta builds, portable apps)?

The article says winget cannot handle programs that are not in the repository, beta-channel builds, and portable builds (which still send you back to the vendor site). It also notes winget can fail to update immediately when a vendor ships a new build because the package hash in the manifest is out of date, causing an "installer hash does not match" message until the repository is updated.

Answered

Have a question not listed here? Ask below and TweakBot will answer it.

The reason I trust it more than a download button

Convenience is the easy part to sell, yet the security is what keeps me away from download sites for good. When you install something through winget, the tool pulls the installer straight from the URL listed in the package manifest, commonly the publisher's download URL or the Microsoft Store rather than a mirror or a repackaged copy.

On top of that, every entry in the winget repository stores a SHA256 hash of the exact installer that was approved, and winget checks each download against that hash before it runs. If the two don't match, it refuses to run the file and reports the mismatch, so a tampered or swapped binary is blocked before it can do anything.

There is a further layer of protection before a package ever reaches the repository, as submissions must first pass Microsoft SmartScreen checks and static analysis.

Compare that to the way I used to install things. Ad-heavy download portals wrap installers in their own junk, slip in adware nobody asked for, and disguise fake buttons as the real link, which leaves you trusting a search result and hoping for the best. With winget, I get the publisher's unmodified file with a cryptographic check on top, and I get it every time.

UniGetUI if you'd rather click, and where winget still loses

If the command line isn't for you, UniGetUI offers the same capability with a proper interface. It used to be called WingetUI, and it acts as a free graphical front end for winget, Scoop, and Chocolatey, so you can search for and install apps in bulk while it watches for updates in the background. It's easy to set it up, since you install it with winget itself. Run winget install Devolutions.UniGetUI and it lands on your system in a few seconds. It's also on the Microsoft Store, Scoop, and Chocolatey if you prefer one of those.

I install and update most of my apps with this Windows command now, and I stopped downloading sketchy installers 06

Even so, winget is far from perfect, and I would rather say so plainly. Because each package is tied to a hash, an app will occasionally refuse to update on the very day its vendor ships a new build, because the manifest hasn't caught up yet.

You will see an "installer hash does not match" message until the community submits the correction, which usually happens within hours. Some programs are not in the repository at all, and beta channels or portable builds still send you back to the vendor's own site.

There are also moments when you deliberately want an older version, and for those the winget pin add command locks an app to its current release so winget upgrade --all skips it. Whenever I need the newest build the moment it lands, the manual download still wins; for everything else, which is most of what I run, winget handles it.

I install and update most of my apps with this Windows command now, and I stopped downloading sketchy installers 07

The next step is to stop typing these too

Once these commands feel routine, the next step is to stop running them by hand at all. I keep a short text file of my install lines so a rebuild is copy-and-paste, and scheduling winget upgrade --all through Task Scheduler means updates happen without me having to think about them.