Is DisplayCAL Safe? An Honest Answer
Short answer: yes. DisplayCAL is open-source software whose complete source code is publicly available for anyone to inspect. The warnings you may see from Windows SmartScreen or macOS Gatekeeper are about code signing — not about malware. This page explains what those warnings actually mean, what this website is, and how you can verify everything yourself.
What DisplayCAL Is
DisplayCAL (originally dispcalGUI) is a display calibration and profiling application. The version most people use today is DisplayCAL-py3, a community-maintained Python 3 port hosted publicly on GitHub, currently at version 3.9.19. It is released under the GNU General Public License v3, which means the source code is open and the software is free.
Because the code is public, it has been packaged by Linux distributions, reviewed by developers, and used by photographers, colorists, and researchers for years. Open source does not automatically mean safe — but it does mean there is nowhere for malicious behavior to hide from scrutiny.
Why Windows SmartScreen Shows a Warning
When you run the DisplayCAL installer on Windows, SmartScreen may show a blue “Windows protected your PC” dialog. Here is what that actually means:
- SmartScreen is a reputation system, not a virus scanner. It warns about any executable that lacks an established reputation or a commercial code-signing certificate — regardless of whether the file is malicious.
- The community builds are not commercially code-signed. A code-signing certificate costs money and requires a legal entity; volunteer-maintained open-source projects often do not have one. The absence of a signature triggers the warning even when the file is clean.
- This is not a malware verdict. If Windows Defender’s actual antivirus scan finds nothing, SmartScreen’s warning is purely about the missing signature and low download reputation.
If the warning bothers you, the standard procedure is: verify the file comes from the official GitHub release (see below), then proceed. Millions of legitimate open-source tools trigger the same dialog for the same reason.
Why macOS Gatekeeper Blocks It
On macOS, a freshly downloaded DisplayCAL may refuse to open with a message that it “cannot be opened because the developer cannot be verified.” Again, this is Gatekeeper reacting to the lack of Apple notarization — not a malware finding.
The documented workaround, published with the project’s own releases, is to remove the quarantine attribute in Terminal:
xattr -dr com.apple.quarantine /Applications/DisplayCAL.app
This tells macOS you intentionally downloaded the app. It does not disable any malware protection; it only clears the “downloaded from the internet” flag for this one application.
What This Website Is (Transparency)
displaycal.org is an independent resource site. We are not affiliated with the DisplayCAL-py3 maintainers, with Florian Höch (the original author), or with displaycal.net. We do not develop the software.
Our download page links directly to the official sources — the GitHub releases of DisplayCAL-py3, displaycal.net for the legacy 3.8.9.3 line, and argyllcms.com for ArgyllCMS. No account is required, no files are repackaged, and there is no intermediary: the file you download is exactly what the developers published.
How to Verify a Download Yourself
- Download DisplayCAL from the official GitHub repository’s releases page.
- Compare the file name and size against the release notes on that same page.
- Run your own antivirus scan on the file — it should come back clean.
- Check that the app behaves as documented: it asks for ArgyllCMS on first launch and requests no unusual permissions.
No download source — including ours — should ask you to disable your antivirus or grant the installer administrator rights beyond the normal installation prompt. If anything ever does, stop and investigate.
What Permissions Are Normal (and What Are Not)
Knowing what a legitimate install asks for helps you spot anything unusual:
- Windows: the installer asks for administrator rights (normal for any program installing to Program Files). At runtime, DisplayCAL asks for nothing beyond USB access to your colorimeter.
- macOS: first launch may ask about Input Monitoring or screen recording permission — this is how the app draws measurement patches and reads the sensor, and it is expected.
- Red flags: an installer that demands you disable antivirus, asks for credentials it should not need, or downloads extra payloads from unfamiliar domains. A genuine DisplayCAL install does none of these.
Why Open Source Matters Here
Closed-source calibration tools ask you to trust the vendor. With DisplayCAL, trust is verifiable rather than promised:
- The full source history is public on GitHub — every change is attributed and reviewable.
- Linux distributions (Debian, Fedora, Arch) build and ship their own DisplayCAL packages from that source, which means independent packagers have compiled and run the code.
- Security researchers and developers can — and do — read the code. There is no obfuscated binary blob where malicious behavior could hide from scrutiny.
None of this replaces your own judgment, but it is a fundamentally stronger position than “trust us.”
If You Are Still Unsure
A reasonable cautious workflow:
- Download only from the GitHub releases page.
- Scan the file with Windows Defender (or your antivirus of choice) before running it.
- Install it in a standard user account and watch what it does on first launch: it should ask where ArgyllCMS is, not for anything unrelated.
- Check community discussion on the GitHub issue tracker if a specific warning puzzles you — chances are someone has asked about it already.
Common Warnings, Translated
| Warning you see | What it means | What to do |
|---|---|---|
| “Windows protected your PC” (SmartScreen) | App is unsigned / low reputation | Verify source, then “More info → Run anyway” |
| “Cannot be opened because the developer cannot be verified” (macOS) | App is not notarized by Apple | Run the xattr quarantine command above |
| Browser: “This file is not commonly downloaded” | Heuristic download warning | Keep the file, scan it yourself |
| Antivirus quarantine / trojan naming a threat | Actual detection — take seriously | Stop, delete the file, re-download from GitHub |
The last row is the important one: a reputation warning and a detection are different things. The first three rows are routine for unsigned open-source software. The fourth is not — if a real antivirus engine names a specific threat, believe the engine, not this page.
Frequently Asked Questions
Is DisplayCAL a virus?
No. It is open-source software with public source code, packaged by Linux distributions and used professionally for years. Antivirus scans come back clean; SmartScreen/Gatekeeper warnings are about code signing, not malware detection.
Why does my browser warn about the download?
Browsers warn about uncommonly downloaded executables as a precaution. Downloading from the official GitHub release and scanning the file yourself is the way to be certain.
Is displaycal.org the official website?
No. This is an independent resource site. The software’s official home is its GitHub repository; the original author’s site is displaycal.net. We link directly to both official sources; we do not repackage or re-host the files.
Why do some people online say not to download DisplayCAL from random sites?
Because repackaged installers are a real phenomenon with popular free software: third parties bundle adware with otherwise legitimate programs. The defense is simple — download from the official GitHub release, and be suspicious of any installer that behaves differently from what is described on this page.
Do I need to disable my antivirus to install DisplayCAL?
No. A legitimate DisplayCAL install never requires disabling antivirus software. If any download asks you to, treat it as a red flag.