Software vendors publish a checksum next to each download. If the hash you compute matches, the file is exactly what they published. If not, do not install it.
Built and maintained by the Arventiq Labs team in Bengaluru. Free for anyone, source on GitHub (MIT). Results are indications, not verdicts. Something wrong? Tell us.