Short answer: yes, GIMP is safe for normal use when you get it from gimp.org or a store that the project links to. It is open source, needs no account, and its privacy policy says it collects no personal data. The thing to watch is your download source, because fake GIMP sites and search ads have spread malware before.
For GIMP, "safe" has two halves. The copy you install has to be genuine, and it has to be current, because an editor that reads dozens of image formats keeps collecting file-parsing bugs. This guide draws on our GIMP Trust Report, re-checked against gimp.org in October 2026; our methodology page explains how those reports are built.
Key takeaways
- GIMP's official builds are listed on gimp.org/downloads, covering Windows (installer or Microsoft Store), macOS (separate Apple Silicon and Intel DMGs) and Linux (Flathub, Snap or AppImage).
- GIMP's privacy policy states that the software does not collect, transmit, share or use personal data, and the update check in official desktop packages runs at most once a week and can be switched off.
- In late October 2022, a Google search ad displaying "GIMP.org" sent people to a lookalike site that served the Vidar info-stealer, as BleepingComputer reported.
- GIMP 3.2.6, released September 10, 2026, patched 27 CVEs, and every one sits in code that imports image formats such as PSD, TIFF and ICO.
- GIMP's own manual warns that plug-ins are full executable programs that can do anything other software can, so install only plug-ins from sources you trust.
Where to download GIMP safely
Get GIMP from the official downloads page or a store that page links to. The current release there is GIMP 3.2.6.
GIMP's privacy policy says the team does not vouch for third-party packages, which may bundle extra software or modified code. In 2015 the project publicly objected when a download mirror served an ads-enabled GIMP for Windows installer, as The Register reported.
Four checks take a couple of minutes:
- Type gimp.org yourself. A search ad can display one domain and send you to another.
- Compare the SHA256 checksum. The downloads page lists one for every installer, DMG and AppImage. Run
Get-FileHashin PowerShell,shasum -a 256on macOS orsha256sumon Linux, and the result should match exactly. - Open the VirusTotal report. Each binary on the downloads page links to a VirusTotal scan of that exact file.
- On Windows, look for a signature. Our Trust Report records that the official installer is digitally signed. If the file's Properties window has no Digital Signatures tab, delete it and download again from gimp.org.
GIMP on a Mac
GIMP has offered native Apple Silicon builds since December 2022. The downloads page provides one DMG for Apple Silicon and one for Intel, both requiring macOS 11 Big Sur or newer, and About This Mac tells you which chip you have.
The project's macOS packaging script, public on GNOME GitLab, signs release builds with an Apple Developer ID certificate and submits them to Apple for notarization. If macOS says it cannot verify the developer of a GIMP you just downloaded, don't override the warning. Download it again from gimp.org and compare the checksum.
Per the downloads page, the GIMP team provides no package on Apple's App Store, so any listing there is third-party.
What GIMP does with your data
GIMP's privacy policy says the software and its community do not collect, transmit, share or use personal data. Logs, settings, caches, thumbnails and your recent-files list stay on your own machine, and there is no account to create.
The official Windows installer, macOS packages and AppImage include an update check. Per the policy, it requests a static file over HTTPS at most once a week, only to learn whether a new version exists. You can switch it off under Preferences > System Resources > Check for updates.
GIMP also goes online when you ask it to, for example to open a remote file or the online user manual. If you install through Flathub, the Snap Store or the Microsoft Store, the policy notes that those stores may collect generic usage data under their own terms.
Security track record
GIMP's recent vulnerabilities follow one pattern: someone crafts a malicious image, you open it, and a parsing bug could let their code run with your user permissions. GIMP's manual notes that importing and exporting images is handled by plug-ins, and that is where these bugs live.
- In 2023, Trend Micro's Zero Day Initiative (ZDI) reported four flaws in the DDS, PSD and PSP importers (CVE-2023-44441 through CVE-2023-44444, each rated 7.8 by ZDI). GIMP 2.10.36 fixed them on November 7, 2023.
- In 2025, an ICO-parsing flaw in GIMP 3.0.2, later filed as CVE-2025-5473, drew press warnings on May 13, 2025. The fix was already in the public source code, and GIMP 3.0.4 shipped it five days later.
- In 2026, the GIMP 3.2.6 release notes list 27 CVEs patched on September 10, 2026, covering importers for PSD, TIFF, SGI, APNG, ICO, XWD and other formats. Several of those CVE records went public in July and August, so anyone still on 3.2.4 or older should update.
The project credits better security detection tools for surfacing more of these bugs. Update when a release lands, and treat image files from strangers like email attachments.
Our Trust Report records no published independent security audit. The source code is public on GNOME GitLab, though public code and a formal audit are different things, as our explainer on how open-source audits work covers.
Fake downloads and plug-ins: where GIMP users get hurt
The 2022 fake search ad
In late October 2022, people searching Google for "GIMP" saw an ad that displayed GIMP.org as its destination. BleepingComputer reported on November 1, 2022 that it led to a lookalike site serving a roughly 700 MB "Setup.exe" that was really the Vidar info-stealer, padded from under 5 MB to look like a genuine installer.
Vidar targets saved browser passwords, cookies and cryptocurrency wallets. We found no newer GIMP-specific ad campaign documented since, but unofficial "download GIMP" sites still show up in search results, so the checks above still apply.
Plug-ins and scripts are real programs
GIMP's user manual is blunt here. It says plug-ins are full-fledged executable programs that can do anything other programs can, including installing back doors, and tells you not to install one unless it comes from a trusted source. GIMP's developer documentation treats Python and Script-Fu scripts as plug-ins too, so the warning covers them.
- Prefer plug-ins whose source code sits in a public repository with recent activity, downloaded from the author's own page.
- Open a Python or Script-Fu file in a text editor before installing it. A photo filter has no reason to make network requests or read your documents.
- Be wary of unofficial "GIMP 3 ports." The manual notes that GIMP 3.0 changed the plug-in API, so a port the original author never published deserves extra suspicion.
GIMP vs. Krita and Photopea: the trust picture
| App | License | Where your data goes | Download verification | Notable caveat |
|---|---|---|---|---|
| GIMP | Open source (GPL-3.0-or-later) | Privacy policy says data stays local; optional weekly update check | SHA256 checksums and VirusTotal links on gimp.org; signed Windows installer | Many file importers; 27 CVEs fixed in 3.2.6 |
| Krita | Open source (GPL-3.0-only) | Privacy statement says no personal data is accessed or transmitted | GPG signatures; signed macOS DMG | Flathub and Snap builds are community-maintained |
| Photopea | Proprietary; ad-supported free tier | Privacy policy says opened files are never sent anywhere | Web app served from photopea.com, so nothing to checksum | Closed source; no published audit |
GIMP and Krita offer the same kind of trust: public code, verifiable downloads and documented no-collection policies. Photopea asks you to trust a closed codebase in exchange for zero installation, a trade-off we cover in is Photopea safe. For features rather than trust, see our GIMP vs Krita comparison.
When to pick something else
- You mostly paint or illustrate. Krita is built around its brush engine and has the same open-source trust profile.
- You can't install software, for example on a locked work laptop. Photopea runs inside the browser, if you accept closed source.
- You want a Photoshop-style layout. Our roundup of free Photoshop alternatives and the best free photo editors list compare the options.
- Your workplace requires a vendor security attestation. GIMP has no published independent audit, so check with IT or browse GIMP alternatives your team may already approve.
The bottom line
In our view, GIMP is safe for normal use if you download it from gimp.org or a store that page links to, keep it on the current release, and give third-party plug-ins the same scrutiny as any program you install. Its privacy record is strong, and its weak spot, file parsing, is the part that updates fix. Features and pricing change, so always check the official site before deciding.
FAQ
Is GIMP safe to download?
Yes, when you download it from gimp.org/downloads or a store that page links to, such as the Microsoft Store, Flathub or the Snap Store. The page lists a SHA256 checksum and a VirusTotal report for every installer, so you can confirm your file is genuine. Avoid search ads and unofficial download sites, which have delivered malware disguised as GIMP.
Is GIMP safe to use?
For everyday editing, yes. GIMP needs no account, its privacy policy states that it collects no personal data, and per that policy the automatic network activity in official builds is a weekly update check you can turn off. The main risk is opening a booby-trapped image on an outdated version, so install updates such as GIMP 3.2.6 promptly.
Is GIMP safe for Mac?
Yes, if you use the official DMG from gimp.org. The project offers separate native builds for Apple Silicon and Intel Macs running macOS 11 or newer, and its packaging script signs release builds and submits them to Apple for notarization. The GIMP team does not publish on Apple's App Store, so App Store listings come from third parties.
Is GIMP safe to download on my computer?
On a Windows PC, use the installer from gimp.org or the Microsoft Store listing that page links to. Check that the installer's SHA256 hash matches the downloads page and that its Properties window shows a Digital Signatures tab. GIMP edits files locally, so your images stay on your computer unless you open or save them somewhere remote.
Is GIMP safe to install?
Installing GIMP itself from official sources carries little risk; the riskier installs come afterward. GIMP's manual warns that plug-ins are full programs that can do anything other software can, including installing back doors. Add plug-ins and Script-Fu or Python scripts only from sources you trust, ideally ones with public source code and an active maintainer.