Is Modrinth safe? Mostly yes, with the same catch every mod site has. Modrinth is a real, open source mod host, and its moderators and an in-house malware scanner look at what gets uploaded. But a mod is code that runs on your PC, and in May 2024 a malicious mod did get onto Modrinth. So the safe answer isn't "trust the site." It's "download from the real site, check what you're installing, and never import a modpack file somebody sends you."
Same question about the other big mod host? I wrote it up in is CurseForge safe. And if you're worried about a cracked launcher instead, here's whether TLauncher is safe.
What is Modrinth?
Modrinth is a download site for Minecraft mods, resource packs, data packs, shaders, modpacks and plugins. It also has servers listed now. Every page carries a "Modrinth is open source" line in the footer, and a note that it's not an official Minecraft service and isn't approved by Mojang or Microsoft.
Two things get lumped together:
- The website at modrinth.com, where you browse and download files by hand.
- The Modrinth App, a launcher that installs mods and modpacks for you and keeps them updated. Its download page calls it an open source launcher, and labels it a beta release.
How Modrinth checks mods
Modrinth's Help Center says its content moderators review submitted projects to make sure they follow the site's Rules and Terms of Use. It also mentions an in-house malware scanning tool. If the scanner spots suspicious traces in a project's code, a technical moderator reviews the code by hand, and that can slow the review down a lot.
As of October 2026, reviews aren't fast. The same help page warns about delays, and says modpacks take longer because they're harder to review. Expect days to weeks, not an instant approval.
The content rules back that up with things authors aren't allowed to do. Mods can't send your data to a remote server you didn't choose to connect to without clear disclosure. Authors can't impersonate other people or fake an affiliation. And you can't reupload someone else's work without their permission. If you spot something wrong, every project, version and user page has a Report button.
What the Security Notice is (and isn't)
If you've searched this question, the Security Notice at modrinth.com/legal/security probably came up. It isn't a description of how mods are moderated. It's a vulnerability-reporting policy: if you find a hole in Modrinth's software, it tells you to email support@modrinth.com instead of opening a GitHub issue. It says nothing about scanning mods, so don't read it as a safety guarantee either way.
What went wrong before
fractureiser in 2023: Modrinth wasn't hit
The big 2023 malware outbreak, fractureiser, spread through files on CurseForge and BukkitDev. Modrinth said all of its projects had been scanned and weren't affected. The community investigators' guide backs that up: Modrinth ran a full scan of the previous ten months of uploads and found no infected projects. The investigators' words on why: "The fact no mods were infected there was entirely luck."
They also said it wasn't a website-level problem and that Modrinth is "just as safe as CurseForge is." They added that both platforms were considering automated virus scanning, and that it's hard, because Java malware like this is usually custom-made.
Windows Borderless in 2024: a malicious mod that got through
This one is worth knowing, because it shows how the real risk works. Modrinth published its own disclosure on May 7, 2024. The timeline:
- April 29: a mod called "Windows Borderless" was submitted with one clean file.
- April 30: moderators approved it.
- May 2: a new version went up containing malware. The first one only sent machine info to a Discord webhook.
- May 4 to May 6: more versions followed that stole credentials and tokens.
- May 6: a user reported that their Discord account had been compromised. Within a few minutes of investigating, moderators took the project and everything else by the same users down.
Modrinth rated the exposure low: about 372 distinct IPs downloaded the affected files, and one Discord account was alleged to have been stolen. It also said none of the files were in modpacks on Modrinth. The advice for anyone who ran it: delete the mod, change your passwords, and watch your bank accounts. Modrinth also released an open source detection tool and said it was working on letting launchers check files against a known-malware database.
The lesson isn't "Modrinth is unsafe." The first file was clean and got approved, the bad code arrived in later updates, and a user report is what caught it. That's the pattern to keep in mind.
Where the risk actually lives
- Mods are code. The fractureiser investigators say to treat a mod like an .exe, because it can do anything.
- Updates. Windows Borderless is the proof. A mod being fine last month tells you what last month's file did.
- Files that don't come from Modrinth. Modrinth's modpack format is
.mrpack. If someone sends you one on Discord, or a ZIP, that file didn't come from a Modrinth project page. Modrinth's own app now warns when you install unknown modpack files, and its changelog says the warning is there to help mitigate ongoing scams. If that pop-up shows up, treat it as a stop sign. - Infected authors. The fractureiser investigators note that a dev with an infected PC can pass malware into the mods they upload. Which is why the author and the history matter.
How to download from Modrinth safely
- Type modrinth.com yourself instead of clicking a link from a video description or DM.
- Look at the author. A name with a long list of projects beats one with a single upload.
- Check downloads, update dates and comments. New projects take a while to get reviewed and have little history, so be most careful when you sort by newest.
- Be extra careful on updates from small or brand-new authors. Windows Borderless went bad on version two.
- Never import a modpack or ZIP somebody sends you. Get packs from the project page. For ones worth installing, see the best Minecraft modpacks.
- Don't keep a mod that acts strangely. Delete it and use the Report button.
- Skip cracked packs and "free" account tools. There's no safe version of those.
- If you ever run something bad, change your passwords from a different device and check your accounts.
If you're setting up a modded server for friends, how to make a modded Minecraft server covers it.
Is the Modrinth App safe?
It's open source, it comes from modrinth.com/app, and it's the official Modrinth launcher. That's the good part. As of October 2026 it's still labeled beta, and Modrinth patches it a lot. The changelog shows security fixes this year, including one that was privately reported, and new warnings when you install unknown modpacks or unknown mods. Keep it updated.
The app also asks you to sign in with your Minecraft account, since it needs that to launch the game. Only do that in the app you downloaded from the real page.
Linux users: the download page points to Flathub and says the other formats are for people who know what they're doing. It also says Linux builds have issues on some systems and suggests Prism Launcher. For a rundown of the alternatives, see the best Minecraft launchers.
Modrinth vs CurseForge: which is safer?
Neither, as far as anyone has shown. The fractureiser investigators said Modrinth is just as safe as CurseForge. Both use automated checks and moderators. Both have had a bad upload episode: CurseForge in 2023 through hijacked author accounts, Modrinth in 2024 through an update to an approved mod. The risk underneath is identical, because it's executable code.
The differences are practical. Modrinth's site and app are open source, and the app is in beta. CurseForge is owned by Overwolf and covers other games too. Pick the one that has the mod you want, and use the same habits on both.
FAQ
Can I trust Modrinth?
You can trust it to be the real mod host, with moderators and a malware scanner. You can't trust every file on it without looking, which goes for any mod site.
Are there viruses on Modrinth?
It's happened. The case Modrinth disclosed was Windows Borderless in 2024: the malware came in through updates, and the project was pulled after a user report. Modrinth wasn't hit by fractureiser in 2023.
Is Modrinth safer than CurseForge?
Nobody's shown it. The investigators who looked at both said they're just as safe.
Is the Modrinth App safe?
It's the official launcher, it's open source, and it's still in beta. Download it from modrinth.com/app, keep it updated, and take its unknown-modpack warning seriously.
Is Modrinth safe for kids?
The risk is the files, not the age of the player. If a kid is installing mods, sit down and go through the checklist above together.