The short answer
- The official builds come only from GitHub (storytold/photocraft) and the developers' page on getartcraft.com.
- Windows installers and executables are code-signed. The macOS app and command-line tool are signed with a Developer ID and notarized by Apple.
- Every release has a SHA256SUMS.txt file, so you can prove your download hasn't been altered.
- The source code is public, so anyone can review what the app does.
- It is early-alpha software: it can crash or mis-render files. Keep backups of anything important.
Watch out for fake and outdated download sites
Within days of PhotoCraft going viral, download portals and lookalike domains appeared. Some only mirror old versions; others could wrap the installer in adware. The repository lists only GitHub and getartcraft.com as official, so treat every other site as third-party, including domains with "photocraft" in the name. That includes this guide: we link to the official files and never host installers ourselves.
- PhotoCraft is free. Any site asking for payment, a "Pro" licence key or a "crack" is a scam.
- Official file names look like photocraft-0.7.0-windows-x64.msi. Be suspicious of .exe "downloaders" or setup files with different names.
- The official Windows download is an .msi or a portable .zip, never a small .exe stub.
How to verify your download
Download SHA256SUMS.txt from the same GitHub release and compare its line for your file with the checksum on your computer:
# Windows (PowerShell)
Get-FileHash .\photocraft-<version>-windows-x64.msi -Algorithm SHA256
# macOS
shasum -a 256 photocraft-<version>-macos-universal.dmg
# Linux
sha256sum -c SHA256SUMS.txt --ignore-missingCheck the signature
On Windows, right-click the .msi › Properties › Digital Signatures. A signature should be listed; if the tab is missing, don't run the file.
On macOS, the official DMG opens without a Gatekeeper warning. For the command-line tool, spctl --assess --type install -vv photocraft-cli should report "accepted, source=Notarized Developer ID".
Opening PSDs and images from strangers
The project's own security policy tells you to treat PSD, PSB, .pcraft, raster images, colour profiles, LUTs and embedded content as potentially malicious. Its parsers are hardened and fuzz-tested, but like any complex file reader they are an attack surface. Be careful with files from unknown sources, especially on machines holding sensitive data.
Privacy
PhotoCraft needs no account and works offline. Smart selection tools such as Select Subject run on your own machine rather than in the cloud.
Automation and MCP
If you let an AI agent drive PhotoCraft through MCP, it can only read and write inside the folders you grant with --automation-read-root and --automation-write-root. The desktop control channel listens on loopback only and requires a secret token. The developers warn not to expose either one to untrusted networks or brokers.
Is it legal to use?
PhotoCraft describes itself as a clean-room reimplementation, written from public specifications and observed behaviour with no Adobe code, shaders or assets. It is released under MIT or Apache-2.0, and Adobe's trademarks are mentioned only to describe compatibility. Using it costs nothing and requires no licence from Adobe.
Frequently asked questions
Is PhotoCraft a virus?
No. The official builds are open source, code-signed on Windows and notarized on macOS. Antivirus warnings usually come from unofficial repackaged downloads; delete those and download from GitHub.
Why does Windows SmartScreen warn me about PhotoCraft?
SmartScreen also weighs how many people have downloaded a file. Brand-new releases can trigger it even when signed. Check the digital signature and the SHA-256 checksum before you run it.
Is photocraft.one (or .im, .wiki) the official site?
The GitHub repository lists only getartcraft.com/apps/photocraft as its website. Other PhotoCraft-named domains, including this guide, are third-party sites.
Does PhotoCraft collect my images?
It needs no account and its AI-assisted selection runs locally. Your files stay on your computer unless you share them.
How do I report a security problem in PhotoCraft?
Follow SECURITY.md in the GitHub repository: contact the maintainers privately and don't post working exploits or malicious sample files in public issues.