A valid code signature does not guarantee a quiet install. Microsoft says SmartScreen weighs publisher reputation and file hash reputation, so a new signed binary can still show an "unrecognized app" prompt until enough clean downloads accumulate. Signing helps reputation carry across versions, but it does not erase the first warning.
The two signals SmartScreen uses
According to Microsoft's documentation for app developers, SmartScreen looks at whether the file is signed by a known publisher, and at whether this exact file has been downloaded by other users without signs of malicious behaviour.
If either signal is unknown or negative, a warning can appear. A freshly built binary has no hash history, and a new certificate has no publisher history. That is why a brand new product from a careful team can still get the prompt.
What signing changes
Signing changes what the user sees and how reputation behaves over time.
- The prompt shows the verified publisher name, which gives users something to check.
- Reputation attached to the certificate can help later releases signed with the same identity.
- Unsigned files start from zero for every new version, because there is no publisher identity to inherit from.
Microsoft also notes that changing your signing identity affects the publisher trust signal, so avoid switching certificates without a reason.
What to do for a new release
You cannot submit a consumer file for a reputation review, according to the same page. Reputation builds from download volume and behaviour. Microsoft says the prompt stops once the hash has enough history, and that this can take weeks and many clean installs from a wide audience.
Practical steps:
- Sign every release, including the installer and the binaries inside it.
- Keep one signing identity across releases.
- Do not alter files after signing, since that can break the signature.
- Tell early adopters about the prompt and what a correct publisher name looks like.
- Never sign anything that behaves like potentially unwanted software, because the certificate can pick up negative reputation.
What to tell users
Users should proceed only when the publisher name matches what they expect and the download came from your official page. A prompt on a first release is not proof of a problem, and its absence is not proof of safety either. Pair the download page with a published checksum so careful users have a second check. Our guide on checksum versus signature explains how the two differ.
The Store route
Microsoft states that apps published through the Microsoft Store are re-signed by Microsoft and are not subject to SmartScreen download warnings. If your product can ship that way, it is the most direct way to avoid the prompt. If it cannot, the steps above are the realistic path.
Common mistakes
Teams often sign the installer but forget the executables inside it, which leaves unsigned files with no reputation. Others switch certificates between releases and lose the carried reputation. A third mistake is repackaging a signed file with a different tool after the fact, which can break the signature. Build a single signing step that covers everything and runs last.
Quick check
Does an EV certificate remove the SmartScreen prompt?
Not according to Microsoft. Its documentation says EV certificates no longer bypass SmartScreen and may matter mainly for enterprise procurement.
Is the prompt a sign the installer is malicious?
No. On a new release it usually means reputation has not built yet. Check the publisher name and the download source before continuing.
Sources
Last reviewed: 19 October 2026.
