It is as safe as the server and the connection behind it, and you cannot see what you run. A safer habit takes thirty seconds: download the script to a file, read it, then run it. For anything on a production machine, prefer a package manager or a verified checksum.
What happens when you pipe
The command downloads a script and hands it straight to a shell, with your user's permissions. There is no pause where you could read it. If the script is long, you could not read it anyway, but the option should exist.
What can go wrong
- A changed script. Whoever controls the server, or anyone who compromises it, can change what you receive.
- A cut connection. A download that stops midway can leave a half script that still runs its first lines.
- Different content for different callers. A server can answer a command line client differently from a browser, so reading the page in a browser proves little.
- Wrong address. A mistyped or lookalike domain serves someone else's script.
A safer way to run the same installer
curl -fsSLo install.sh https://example.com/install.sh
less install.sh
sh install.sh
Download first, read it, then run. If the vendor publishes a checksum or signature for the script, verify it before running. Use https only, and copy the address from the project's own documentation.
When it is a reasonable risk
A throwaway virtual machine, a disposable container or a CI runner that holds no secrets is a fine place to try an installer. A laptop with your cloud credentials in the home folder is not.
What to look for when reading the script
Does it download more files, and from where? Does it ask for administrator rights? Does it edit shell profiles, add cron entries or install services? A short installer that does a clear job and nothing else is a good sign.
Better still
Check whether the tool is available through your operating system's package manager or a signed installer. Those add a verification step you did not have to build yourself.
Quick check
Is https enough to make curl piped to a shell safe?
No. It protects the connection, not the content. A compromised or malicious server still sends you a script you have not read.
Is downloading and then running really safer?
Yes, a little, because you can read it and verify a checksum before it runs.
Last reviewed: 19 October 2026.
