Is PhotoCraft safe?

Short answer: the official PhotoCraft builds are signed, the source is public and each release has checksums, so the main risk is downloading the wrong thing from the wrong place. Here is what is known, what is not, and how to check for yourself.

Download only from the official PhotoCraft page or the GitHub releases page. This site hosts no installers.

What the project documents

Question	What the project says
Is the code public?	Yes. The full source is on GitHub under MIT or Apache-2.0.
Are Windows builds signed?	Yes. “Installers and executables are code-signed.”
Are macOS builds signed?	Yes. The app and the command-line tool are signed and notarized by Apple.
Are there checksums?	Yes. `SHA256SUMS.txt` lists one for every file in a release.
Does it need an account or the cloud?	No account. Described as offline, with smart selection running on your machine.
Does it contain Adobe code?	No. Described as clean-room: public specifications and observed behaviour only.

What that does and does not prove

Signing shows that a file came from the publisher and was not altered afterwards. It does not prove the software is free of bugs.

Open source means anyone can read the code, and with more than 55,000 stars and many outside contributors, a lot of people are looking. It is not the same as a formal security audit, and this site knows of none.

Checksums protect you from a corrupted or swapped download, as long as you take the checksum file from the official release.

This site has not independently tested PhotoCraft for security problems or monitored its network traffic. Everything above is what the project states.

The real risk: look-alike downloads

“PhotoCraft” is not a unique name. App stores list several unrelated apps called PhotoCraft or Photo Craft from other publishers. Third-party download sites have already started offering their own copies of the installer. Neither is the open-source editor’s official channel.

The genuine files are named photocraft- plus the version, for example photocraft-0.8.2-windows-x64.msi or photocraft-0.8.2-macos-universal.dmg. The PhotoCraft download page lists all of them with sizes.

How to verify your download

Download your build and SHA256SUMS.txt from the same official release.
Compute the SHA-256 checksum of your file.
Compare it with the line for that file name. They must match exactly.

# Windows (PowerShell)
Get-FileHash .\photocraft-0.8.2-windows-x64.msi -Algorithm SHA256

# macOS
shasum -a 256 photocraft-0.8.2-macos-universal.dmg

# Linux
sha256sum photocraft-0.8.2-linux-x86_64.AppImage

On macOS you can also confirm notarization of the command-line tool. The project gives this command, which should report “accepted, source=Notarized Developer ID”:

spctl --assess --type install -vv photocraft-cli-0.8.2-macos-universal/photocraft-cli

Is it safe for your files?

This is the more practical worry with software this young. Good signs: version 0.3.0 made recovered unsaved documents survive a second crash and fixed cases where preferences were lost, and anything PhotoCraft does not understand in a PSD is carried over instead of dropped.

Reasons for care: it is at version 0.8.2, two of the 309 PSD test files do not round-trip unchanged, and a re-saved PSD is never byte-identical to the original. Work on copies, and keep the originals until you have checked the result.

Is the automation safe?

PhotoCraft can be driven by scripts and AI agents. Since 0.2.0, file access from automation clients is limited to folders you explicitly grant, and without those grants file operations fail. The desktop control channel only listens on the local machine and requires a token printed at each launch. Normal use through the app’s own dialogs is unaffected.

Is PhotoCraft safe? Questions

Is PhotoCraft safe to install?

The official builds are code-signed on Windows and signed and notarized on macOS, the source code is public, and every release has checksums. Downloaded from the official page and verified, it carries the normal risk of any new open-source app. Files from unofficial download sites do not have those guarantees.

Is PhotoCraft a virus?

There is no evidence of that for the official builds. The real risk is look-alike downloads: unrelated apps with a similar name, or repackaged installers on third-party sites. Download only from getartcraft.com or the storytold/photocraft repository on GitHub.

Does PhotoCraft upload my images?

The project describes it as offline and says smart selection runs on your machine with no cloud and no account. This site has not audited its network activity.

Does PhotoCraft need an account?

No. The project states there is no account.

Is it safe to let an AI agent control PhotoCraft?

Automation is locked down by default since 0.2.0: file access from automation clients is limited to folders you grant, and the desktop control channel is loopback-only and needs a per-launch token. Only grant the folders an agent needs.

Could PhotoCraft damage my PSD files?

It is early software. Work on a copy. The project reports that two of 309 test files do not survive a round trip unchanged, and that a re-saved file is never byte-identical to the original.