ASAR integrity makes an Electron app check the hash of its app.asar archive when it starts, and quit if the hash is wrong. It is off by default. To get any value you must enable two fuses together and let your packager embed the expected hash.
What it protects
An Electron app's own code usually sits in an archive called app.asar. On a user's machine, someone with file access could edit that archive, for example to add a keylogger to an app the user trusts. Integrity validation raises the cost of that edit. According to the Electron docs, the app verifies the archive header hash, and terminates if it is missing or does not match.
Platforms and versions
The docs list macOS support from Electron 16 and Windows support from Electron 30. Linux is not listed. If you ship on Linux, do not tell customers that integrity checking covers that build.
How to turn it on
- Enable the
EnableEmbeddedAsarIntegrityValidationfuse. It defaults to disabled. - Enable the
onlyLoadAppFromAsarfuse. The docs say that without it the check can be bypassed through the app code search path. - Make sure the header hash is supplied at packaging. On macOS this is an ElectronAsarIntegrity entry in Info.plist. On Windows it is a resource named ElectronAsar. Electron Forge and Electron Packager do this automatically in recent versions.
Verify the result with the fuse read command from the fuses guide, and test it: change a byte in a packaged build and confirm the app refuses to start.
What it does not do
Be honest about the limits in documentation and customer answers.
- It does nothing unless the fuse is enabled.
- It checks the archive, so code stored outside the archive is not covered, which is why the second fuse matters.
- The expected hash lives inside the packaged app. An attacker who can rewrite both the archive and the hash location is a different problem. That is where code signing comes in, because a modified bundle should no longer carry a valid signature. The Electron pages do not describe this scenario in detail, so test it on your own platform.
- It does not stop a malicious dependency that was bundled before packaging. That is a supply chain question, not an integrity one.
Practical advice
Treat ASAR integrity as defense in depth for desktop installs where users can write to the app folder. Document it as a measure that detects tampering with packaged code on supported platforms, not as protection against a determined attacker with full control of the machine.
Quick check
Is ASAR encryption the same as integrity validation?
No. Integrity validation detects changes. It does not hide the code, and anyone can still read an unencrypted archive.
Sources
Last reviewed: 19 October 2026.
