Is doki safe? Security and privacy
Safe to install. Safe to sign in.
What doki protects, what isn't finished yet, and every service the launcher talks to. All of it written down, and all of it checkable.
What's protected.
- Signed updates
- Every in-app update is signed with doki's private key and checked against it before it installs. An update that doesn't match is refused.
- Encrypted accounts
- Saved sign-ins are encrypted on your PC with AES-256-GCM. On Windows the keys are also protected by DPAPI, which ties them to your Windows user.
- Verified downloads
- Game files, loaders, mods and modpacks are checked against their published hashes. A file that doesn't match is never used.
- Public releases
- The source code is private, but every installer, its checksums and the update files are published in an open GitHub repository.
What isn't done yet.
Said plainly, so it never surprises you at an install prompt.
- Unsigned Windows installer
- doki doesn't hold a Windows code-signing certificate yet, so SmartScreen shows an Unknown Publisher warning on first install. Updates after that are still signature-checked.
- No Mac build
- Without an Apple developer certificate, macOS refuses to open the app. Rather than ship something most Macs would block, there's no Mac version until there's a certificate.
Everything doki connects to.
The full list, from the launcher's own code. Most of it is the same set any Minecraft launcher needs.
- Microsoft and Xbox Live
- Signing in with a Microsoft account. Offline profiles never contact them.
- Mojang
- Minecraft versions, game files, libraries, assets and official skins.
- Modrinth
- Browsing and downloading mods, modpacks, resource packs, shaders and datapacks.
- Loader servers
- Fabric, Quilt, Forge and NeoForge files for the instances you make.
- BMCLAPI mirror
- A public mirror of Mojang, Forge and Fabric files, run by a third party. doki tries it only when the official server fails.
- Adoptium
- Java 8 or 17 when you install them, and a fallback Java if the bundled one is ever missing.
- Skin preview services
- Player heads and skin previews in the launcher, from mc-heads.net, Visage and Starlight Skins.
- GitHub
- Checking for updates and downloading them from the public release repository.
- doki API
- Launcher news, Friend Zone and chat, player profiles and featured servers, including how often each featured server is shown and joined.
- Minecraft Wiki
- Only when you open the Wiki page inside the launcher.
- Discord
- Rich Presence talks to the Discord app on your own PC, only while it's switched on.
Check it yourself.
Every release lists the SHA256 checksum of each file in SHA256SUMS.txt. Run one command on the file you downloaded, and the result should match its line exactly.
Windows
certutil -hashfile <file> SHA256Linux
sha256sum <file>Find the checksums on the releases page or in the release repository.
Ready when you are.
One download. Every version, every loader, every modpack.