A prod keys download is safe when it is a plain text file with the expected key names and a published SHA-256 hash that matches. Key files cannot run code; the danger comes from executables and archives that only pretend to be keys or emulators.
How is every file tested before it is listed?
- The file is opened in a text editor or archive tool; key files must be plain text, firmware must be a ZIP of NCA files only.
- Its SHA-256 hash is calculated and published in the download box.
- The file is installed in the latest official Lichii build (117) with Tools > Install Decryption Keys or Tools > Install Firmware.
- A game is launched to confirm the keys decrypt it.
- The check date is updated on every page at once.
How do you verify a SHA-256 hash yourself?
On Windows, run certutil -hashfile prod.keys SHA256 in Command Prompt. On Linux and Steam Deck, run sha256sum prod.keys. On macOS, run shasum -a 256 prod.keys. The 64-character result must match the hash in the download box exactly.
What is a red flag in a keys or firmware download?
- An
.exe,.msi,.bat,.scror.apkfile inside a “keys” download. - A password-protected archive; it hides the contents from antivirus scanners.
- A “key generator” or “firmware installer” program; real keys and firmware need no installer.
- A download that asks you to disable antivirus.