DuckDeck Trust

[ Trust / Installing DuckDeck ]

Windows will warn you. Here is why.

When you run the DuckDeck installer, Windows may put a blue box on your screen that says "Windows protected your PC". It looks like a virus alert. It is not one. This page explains what it actually is, why DuckDeck sets it off, and how to check the file yourself instead of taking our word for it.

Windows 10 · Windows 11 · 3 min read

The short version: SmartScreen is a popularity check, not a virus scan. It warns about files it has not seen enough people download yet. DuckDeck is a small app from a one person studio in the Netherlands, so it has not crossed that threshold.

[ 01 ]

What the warning actually says

This is the box, near enough exactly as Windows draws it:

The SmartScreen prompt, reproduced

The word doing the work there is unrecognised. Not infected. Not malicious. Not "we found something". SmartScreen checks the file against Microsoft's reputation database, finds no record of it, and stops rather than guess.

That reputation is tied to one exact file. Not to DuckDeck as a product, not to us as a developer, but to that specific installer, byte for byte. Every new version we ship is a brand new file, which starts from zero all over again.

Would a code signing certificate fix this? Only partly, which is why we have not bought one yet. It would swap "Unknown publisher" for our name in that box, which is nice. It would not remove the first warning, because reputation still has to be earned per file. We would rather put that money into the app and tell you plainly what the warning means.

[ 02 ]

Why DuckDeck sets it off

Three reasons, all of them boring:

  1. It is new. Each release is a fresh file with no download history behind it.
  2. It is small. DuckDeck has been downloaded by a few hundred people, not a few hundred thousand. Reputation is a volume game.
  3. It is not signed. No certificate, so Windows shows "Unknown publisher" rather than a name.

None of that says anything about what the app does. The same warning showed up for tools you have probably used, on the day they first shipped. It is the tax on being new and independent.

[ 03 ]

How to install it anyway

Four clicks, once. After that Windows leaves you alone until the next update.

  1. Click More info in the blue box.
  2. A line appears underneath. Check it reads DuckDeck-Setup.exe and nothing else.
  3. Click Run anyway.
  4. The normal installer opens. Carry on as usual.

If your browser blocks it first

Edge and Chrome run their own version of the same check on the download itself, usually phrased as "isn't commonly downloaded" or "can't be downloaded securely". Open your downloads list, find DuckDeck-Setup.exe, and choose Keep. Then run it.

A genuine safety note: if the file you downloaded is not called DuckDeck-Setup.exe, or the "More info" line shows a different name, it did not come from us. Delete it and download again from our releases page.

[ 04 ]

How to check the file yourself

You should not have to trust a stranger's website. Here is how to confirm it independently.

1. Download from the source, only

There are exactly two safe places, and they are the same file: the button on duckdeck.app, and github.com/julianderksen/duckdeck-release/releases. Every version we have ever shipped is listed there with a date and a changelog. If you found DuckDeck on a download portal or a mirror, that copy is not ours.

2. Scan it

Upload the installer to VirusTotal and let seventy odd engines look at it at once. Expect a small number of heuristic flags on any unsigned installer packed with PyInstaller, which is what DuckDeck is built with. What matters is the pattern: a couple of no name engines is normal, the major ones flagging it is not. If you see the latter, email us before you install anything.

3. Compare the hash

Open PowerShell in your Downloads folder and run:

Get-FileHash .\DuckDeck-Setup.exe -Algorithm SHA256

The result should match the checksum published with that release on the GitHub releases page.

[ 05 ]

Who is behind DuckDeck

DuckDeck is made by Julian Derksen, trading as Dermax, a registered Dutch business (KvK 42134751, VAT NL005523986B94), at Kostverlorenstraat 106, 2042 PL Zandvoort, the Netherlands. Not an anonymous account with a contact form and no name behind it. You can email a human at support@duckdeck.app and get a reply.

What the app does on your machine, in full:

  • The free version runs entirely offline. No account, no telemetry, no analytics, no crash reports. We ask for your email once, at the download, and nowhere else.
  • DuckDeck Pro makes one kind of connection: it checks your license key with our licensing provider, Polar, so the 3 device limit can be enforced. Nothing else about your usage leaves your PC.
  • The website has no cookies and no analytics either.

The long version is in the privacy policy and the terms of service.

[ 06 / Ready when you are ]

Now you know what to expect

DuckDeck is a small tray app that changes your music volume with hotkeys, without touching your game audio, and ducks the music when someone talks in Discord. Windows 10 and 11.

Download DuckDeck

Free, no card. Your email, then the download. Pro unlocks the ducking and the per game profiles, paid once.

[ 07 / Common questions ]

Is DuckDeck a virus?

No. The SmartScreen message is a reputation check, not a virus detection. It appears for any Windows app that has not been downloaded by enough people yet, including plenty of well known tools on their first release.

Why is DuckDeck not code signed?

A certificate costs a few hundred euro a year and only replaces "Unknown publisher" with our name. It does not remove the first warning, because reputation is earned per file. We would rather spend that on the app and be upfront.

Will the warning ever go away?

Yes, for a given release, once enough people have downloaded and run that exact file. Every new version starts over as a new file, so it can come back after an update.

My antivirus flagged it. Now what?

Upload the installer to VirusTotal and look at which engines flag it. Unsigned PyInstaller apps are a common false positive for a few heuristic engines. If something looks off, email support@duckdeck.app with the engine name.

Where can I download DuckDeck safely?

Only from duckdeck.app or the GitHub releases page. Both serve the same file. Do not install DuckDeck from a download portal or a mirror.

Does DuckDeck send data from my PC?

The free version runs entirely on your PC with no telemetry and no account. We take your email at the download so we can send you the link and tell you about updates. Pro makes one connection, to check your license key with Polar.