Is Minecraft Forge safe? The loader itself is. Forge is an open source project with an official download site, and NeoForge and Fabric are the same story. What actually goes wrong is a lookalike download page, a click on the wrong button, or a dodgy mod you add afterwards.
Quick version: get Forge from files.minecraftforge.net, NeoForge from neoforged.net and Fabric from fabricmc.net. On Forge's page, use the (Direct Download) link instead of the big Installer button. Then be picky about mods, because that's where the real risk lives. Details below, as of October 2026.
The official download sites
| Loader | Download from | Where the file lives |
|---|---|---|
| Forge | files.minecraftforge.net | maven.minecraftforge.net |
| NeoForge | neoforged.net | maven.neoforged.net |
| Fabric | fabricmc.net (installer at fabricmc.net/use/installer) | maven.fabricmc.net |
Type the address yourself instead of clicking a search result or a link from a video description. If you landed on a page that only looks like one of these, close it.
Is Forge safe to download?
Yes, from files.minecraftforge.net. Forge describes itself as a free, open-source modding API that "is and will always remain free to use and modify," and its code is public on GitHub at MinecraftForge/MinecraftForge, with hundreds of contributors. You don't pay for it.
The thing that makes people nervous is the download page. It's ad-supported, and it says so: it asks you to allow ads because they're Forge's main source of income. So the page is busy, and the file isn't the problem.
The ad button vs. Direct Download
On each version row, the big Installer button runs through an ad-link service (adfoc.us) before it forwards you to the file on maven.minecraftforge.net. Right next to it is a separate (Direct Download) link that goes straight to the installer on maven.minecraftforge.net. That's the one I click.
It's Forge's own ad gate, so the real file is at the end either way. Still, the Direct Download link skips the ad detour entirely, and it's the one I'd tell a friend to use. (If you want to support Forge, its page points you to LexManos on Patreon as a way to do it with ads blocked.)
Check the hash if you're careful
Forge lists MD5 and SHA1 checksums for each installer on the same page. If you want to be sure the file you got is the file Forge published, compare your download's hash to the one listed. It takes a minute.
If the .jar won't open
Forge's README notes the Java versions it expects: Java 25 for Minecraft 26.1 and up, Java 21 for 1.20.6 through 1.21.11, Java 17 for 1.18 to 1.20.4, Java 16 for 1.17.1, and Java 8 for 1.16.5 and older. It also suggests Jarfix if Windows has trouble launching .jar files. Once the installer runs, it installs Forge into your vanilla launcher setup, and you create a new profile for it.
Is NeoForge safe?
Yes, from neoforged.net. NeoForge is a fork of Forge started by former Forge developers, and many of the same names show up as contributors on both projects. Its GitHub page (neoforged/NeoForge) calls it a free, open-source, community-oriented modding API, under the LGPL-2.1 licence. The download button on the site links to maven.neoforged.net, and I saw no ad gate in front of it. Pick your Minecraft version, grab the installer and run it.
The project also posts security fixes on its news page, which is a reason to keep your loader updated rather than leaving it on whatever you installed a year ago.
Is Fabric safe?
Yes, from fabricmc.net. Fabric Loader is open source under the Apache-2.0 licence, with the code at FabricMC/fabric-loader. The installer page gives you a Windows .exe and a universal .jar, both hosted on maven.fabricmc.net, and points to the docs at docs.fabricmc.net/players/installing-fabric for the steps. Fabric also lists other routes in, such as the Minecraft Launcher, MultiMC, CurseForge, GDLauncher and ATLauncher.
One Fabric quirk: most mods also need Fabric API in your mods folder. That's an ordinary dependency, not a warning sign. If you're weighing Fabric against server software, I wrote up Paper vs. Fabric.
Where the real risk is: mods and fake pages
A mod loader is just the thing that lets mods run. Once it's installed, every mod you drop in is code running on your PC, and that's where you can get hurt. Add a fake download page to that and you've got the two realistic ways this goes wrong. Neither is "Forge is a virus."
The fractureiser lesson
The best-known example is fractureiser, in June 2023. The people who investigated it describe it as a virus found in several Minecraft projects uploaded to CurseForge and BukkitDev. It was embedded in multiple mods, and some of those were added to highly popular modpacks. It targeted Windows and Linux. It was named after the CurseForge account that uploaded the most notable malicious files.
The takeaway is who carried it: mods and modpacks, and accounts on mod sites. Not the loaders. CurseForge said at the time that it wasn't compromised, that a malicious user had made several accounts and uploaded malware projects, and that a separate user account had been hacked. Modrinth reported that it scanned the files uploaded in the previous ten months, about half of everything it hosted, and found none infected.
The investigators' write-up says the event has ended, with no follow-up activity found. They also say copycat malware is still possible, and that machines already infected are still a concern. If you've never used Minecraft mods, they say you're not infected. If you were using mods around then, read the fractureiser user guide on the project's GitHub repo for what to check.
For how each big mod site handles this, see is CurseForge safe? and is Modrinth safe?.
Safe habits for modding
- Type the loader's address yourself.
files.minecraftforge.net,neoforged.netorfabricmc.net. - On Forge, use Direct Download and compare the checksum if you want to be thorough.
- Get mods from the big, known mod sites, and stick to authors with a track record. Be careful with a brand-new author pushing an update to something popular.
- Be wary of modpacks you can't trace. Fractureiser rode in on popular ones. My pick of the best Minecraft modpacks is a better starting place than a random upload.
- Keep your loader updated. NeoForge, for one, posts security fixes.
- Running a modded server? The same rules apply to every mod you put on it. Here's how to make a modded Minecraft server.
And if your download question was really about a performance mod, I did the same exercise for is OptiFine safe?, which has its own ad-link button to watch for.
The short answer
Forge, NeoForge and Fabric are safe when you download them from files.minecraftforge.net, neoforged.net and fabricmc.net. Skip Forge's ad button for the Direct Download link. Then put your suspicion where it belongs: on the mods you install.