---
title: "Verify integrity of TYPO3 code"
manual: "TYPO3 Explained"
version: "12.4"
permalink: "https://docs.typo3.org/permalink/t3coreapi:security-integrity-packages@12.4"
source: "Security/GuidelinesAdministrators/IntegrityOfTypo3Packages.rst"
rendered: "2026-10-21T15:29:37+00:00"
---

> [!WARNING]
> **Attention**
>
> TYPO3 v12 has reached end-of-life as of April 30th 2026 and
> is no longer being maintained. Use the version switcher on the top
> left of this page to select documentation for a supported version of TYPO3.
>
> Need more time before upgrading?
> You can purchase Extended Long Term Support (ELTS) for TYPO3 v12 here:
> [TYPO3 ELTS](https://typo3.com/services/extended-support-elts).

# Verify integrity of TYPO3 code {#security-integrity-packages}

Ensuring that the TYPO3 source code has not been tampered with is very important
for security reasons. TYPO3 can either be installed via Composer or by downloading
a prebuilt package. Each method requires different integrity checks.

## Composer-based installations {#security-integrity-packages-composer}

When using Composer, TYPO3 and its dependencies are downloaded directly by
Composer from trusted sources such as `packagist.org` and `packages.typo3.org`.

To ensure source integrity:

-   Use official TYPO3 packages (for example [`typo3/cms-base-distribution`](https://packagist.org/packages/typo3/cms-base-distribution))
-   Commit the `composer.lock` file to track versions and sources
-   Keep Composer and your system's trusted certificate store (CA certificates)
    up to date to ensure secure HTTPS connections when downloading packages.

Composer ensures a secure and verifiable dependency management workflow. It is
recommended to run Composer locally or in a
[CI pipeline](https://docs.typo3.org/permalink/t3coreapi:ci-cd-for-typo3-projects@12.4),
and [deploy](https://docs.typo3.org/permalink/t3coreapi:deployment@12.4) only the
prepared files - including the `vendor/` directory -
to the production environment.

## Classic (non-Composer) installations {#security-integrity-packages-classic}

If installing TYPO3 via a downloaded archive (ZIP, tar.gz), verify the
SHA2-256 checksum before extracting. Only download from the official site:
[get.typo3.org](https://get.typo3.org).

For details, see: [TYPO3 release integrity](https://docs.typo3.org/permalink/t3coreapi:release-integrity@12.4)

Avoid vendor-provided or pre-installed packages unless you fully trust their
source.