Windows hash
SHA-256 of nmap-7.991-setup.exe, 36 MB:
93BFD37B DB31A7AD FD932BEB 5DBCE060 25DA691D 01A0939E 806EA704 F7367657
File, license, and conduct
The license, the file check, and your own limits
Nmap 7.991 is free software for mapping hosts and services. This page states the legal limit, how to check the Windows installer, and what an antivirus flag on Ncat does and does not mean. It is not a certification, and this site is not a government notice.
Legal use
Scan computers and networks you own, or networks where the owner has given you permission. A lab VLAN, your own servers, and a change window you were asked to run are the normal cases. Scanning a network because it is reachable is not permission.
Unauthorized access and unauthorized scanning are crimes in many countries. Nmap will not ask whether you have that permission. You have to know before you type the target.
The screenshots on this site use scanme.nmap.org because that is the practice host the project publishes for demonstrations. Do not treat any other hostname the same way.
Ethical use
The project's stated aim is to help administrators and auditors see their own networks: which hosts are up, which services are exposed, and which versions are old. Inventory, upgrade planning, and a before-and-after diff with Ndiff fit that aim.
Using the same probes to map a network you do not administer, to hunt for a way in, or to hide the scan from the owner, is outside that aim. Timing templates and extra probe types exist so an authorized test can be adjusted. They are not a license to evade someone else's monitoring.
NSE scripts can log in or enumerate a service. Read the script name. Stay inside the permission you were given. The 7.991 limits (5 seconds without a yield, 400 MB) are safety rails for the scanner, not a judgment about your target.
Source and the published files
Nmap ships with source. The 7.991 source archive is nmap-7.991.tar.bz2, 12 MB, and nmap-7.991.tgz, 15 MB. You can read, modify, and redistribute it under the Nmap Public Source License that comes in that archive. This site does not restate the license clause by clause. Read the copy in the tarball.
Signature
The project publishes a detached signature and hashes for each release file. Windows installers and executables are signed with an EV code-signing certificate for Insecure.Com LLC. Check the hash first, then the signer in the file properties.
What a match proves
A matching SHA-256 means your file is the published installer. It does not mean your antivirus product will be silent, and it does not mean you may scan every address you can route to.
Package list: Download Nmap 7.991.
No malware in the published build
The official installer does not add a toolbar, a browser hijack, or a second program you did not select. The component list is Nmap, the packet driver, Zenmap, Ncat, Ndiff, and Nping.
Antivirus alerts still happen. They cluster on ncat.exe because a remote shell is something those engines are built to notice. The project has said this directly, including on reports against the 7.91 installer and against older Npcap builds where only a couple of engines in a large set raised a flag. Treat a hash mismatch as hostile. Treat a hash match plus an ncat.exe alert as the known false positive, and report it to your vendor if you want the detection updated.
Catalog scores are not this site's rating. Softonic lists 3.8 out of 5 from 190 reviews and still shows 7.97. TrustRadius lists 8.7 out of 10 from 48 reviews. Neither number checks your download of 7.991.
If you did not hash the file, do not install it. Steps: antivirus guide.
Your responsibility
You choose the target, the timing, and the scripts. You keep the hash. You stop if the owner withdraws permission. Nmap is offered without a warranty, which the project states in its own materials. A crash in Zenmap or a wrong OS guess is a tool limit, not evidence that a host is safe.
This page does not create a support contract, a certification, or permission to test a network. Questions about a specific scan belong with the administrator who owns that network.