---
title: "Integrity of TYPO3 Packages"
manual: "TYPO3 Explained"
version: "11.5"
permalink: "https://docs.typo3.org/permalink/t3coreapi:security-integrity-packages@11.5"
source: "Security/GuidelinesAdministrators/IntegrityOfTypo3Packages.rst"
rendered: "2026-10-21T15:30:00+00:00"
---

> [!WARNING]
> **Attention**
>
> TYPO3 v11 has reached end-of-life as of October 31th 2024 and
> is no longer being maintained. Use the version switcher on the top
> left of this page to select documentation for a supported version of TYPO3.
>
> Need more time before upgrading?
> You can purchase Extended Long Term Support (ELTS) for TYPO3 v11 here:
> [TYPO3 ELTS](https://typo3.com/services/extended-support-elts).

# Integrity of TYPO3 Packages {#security-integrity-packages}

In order to ensure that the downloaded TYPO3 package is an official
package released by the TYPO3 developers, compare the `SHA2-256` checksum of
the downloaded package with the checksum stated on the TYPO3 website,
before you extract/install TYPO3. You find the `SHA2-256` checksums on
[get.typo3.org](https://get.typo3.org).

Be careful when using pre-installed or pre-configured packages by
other vendors: due to the nature and complexity of TYPO3 the system
requires configuration. Some vendors offer download-able packages,
sometimes including components such as Apache, MySQL, PHP and TYPO3,
easy to extract and ready to launch. This is a comfortable way to set
up a test or development environment very quickly but it is difficult
to verify the integrity of the components – for example the integrity
of TYPO3.

A similar thing applies to web environments offered by hosting
companies: system images sometimes include a bunch of software
packages, including a CMS. It depends on the specific project and if
you can trust the provider of these pre-installed images, systems,
packages – but if you are in doubt, use the official TYPO3 packages
only. For a production site in particular, you should trust the source
code published at [get.typo3.org](https://get.typo3.org) only.