Minecraft mods have a malware problem. Not because modding is inherently unsafe, but because popular mods get reposted on fake sites, bundled with viruses, and distributed through sketchy links. Verity’s no exception — it’s got over a million downloads, which means it’s a target.
Let’s walk through exactly how to verify you’re downloading the real Verity Mod, what the official sources are, and what to do if you’ve already downloaded from a questionable site.
The Official Sources
There are exactly two places to download Verity Mod safely:
1. Modrinth: modrinth.com/mod/verity-je-official
2. CurseForge: curseforge.com/minecraft/mc-mods/verity-je
That’s it. Those are the only two official distribution channels. If you downloaded Verity from anywhere else — a random website, a YouTube link, a Discord DM, a “free Minecraft mods” aggregator — you need to verify the file before installing it.
The developer, Varmite (ThatMob on YouTube), only distributes through Modrinth and CurseForge. There is no official website for Verity itself (this site is fan-run — check our about page for disclosure). There is no “Verity Mod official download” page. If a site claims to be official, it’s not.
How to Check the File Hash
Every file on Modrinth and CurseForge has a SHA hash — a unique fingerprint that identifies the exact file. If you download a file and its hash matches the official hash, it’s the real deal. If the hash doesn’t match, the file’s been modified or it’s a completely different file.
Here’s how to check:
Step 1: Find the Official Hash
Go to the Verity Mod page on Modrinth or CurseForge. Click on the version you want to download. Look for the file hash — it’s usually listed in the version details or file info.
On Modrinth, you’ll see something like:
SHA1: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0
SHA512: [longer hash]On CurseForge, it’s similar — look for the file details section.
Step 2: Calculate the Hash of Your Downloaded File
You need to calculate the hash of the .jar file you downloaded. The method depends on your OS:
Windows: Open PowerShell and run:
Get-FileHash -Algorithm SHA256 "C:\path\to\verity-je.jar"This outputs the SHA256 hash. Compare it to the official hash.
macOS: Open Terminal and run:
shasum -a 256 /path/to/verity-je.jarLinux: Open Terminal and run:
sha256sum /path/to/verity-je.jarStep 3: Compare
If the hash matches the official hash, the file is authentic. If it doesn’t match, don’t install it. Delete it and download from Modrinth or CurseForge.
Note: The hash changes with each version. Verity 5.7.3 has a different hash than Verity 3.4.1. Make sure you’re comparing the hash for the exact version you downloaded.
Fake Download Sites — What to Watch For
Fake mod sites are everywhere. They look legitimate, have professional designs, and rank high in search results. Here’s how to spot them:
1. The URL is wrong. Official: modrinth.com or curseforge.com Fake: veritymod-download.com, minecraft-mods-free.net, verity-official.org
If the domain isn’t modrinth.com or curseforge.com, it’s not official. Period.
2. They ask you to run an “installer” or “downloader.” Real mods are just .jar files. You download them and put them in your mods folder. If a site makes you run an executable (.exe) to “install” the mod, it’s malware. Stop immediately.
3. The file has a different extension. Real Verity: verity-je-X.X.X.jar Fake: verity-je.exe, verity-je.zip.exe, verity-installer.exe
If it’s not a .jar file, it’s not a mod. Java mods are always .jar files.
4. They ask for personal information. “Enter your email to download” — no. Real mod sites don’t ask for your info. You just click download.
5. The version numbers don’t match. Check the version on the fake site against the version on Modrinth. If the fake site has “Verity 6.0.0” but Modrinth only shows 5.7.3, it’s a fake (or a very outdated cached version).
What If You Already Downloaded from a Fake Site?
If you downloaded Verity from a non-official source and installed it:
1. Don’t panic, but take it seriously. Not every fake mod is malware. Some are just outdated versions reposted without permission. But some contain actual malware — keyloggers, crypto miners, trojans.
2. Check the file hash. Follow the steps above to calculate the hash and compare it to the official hash. If it matches, you got lucky — it’s a legitimate file, just from an unauthorized distributor. If it doesn’t match, proceed to step 3.
3. Scan for malware. Run a full system scan with Windows Defender or your antivirus. If it finds anything, quarantine it and follow the removal instructions.
4. Check for suspicious behavior.
- High CPU usage when you’re not doing anything
- Unknown processes in Task Manager
- Browser redirects or new toolbars
- Passwords not working (indicating a keylogger)
If you see any of these, you might be infected.
5. Change your passwords. If you suspect a keylogger, change your important passwords (email, banking, Minecraft account) from a different device. Enable two-factor authentication where possible.
6. Re-download from an official source. Delete the questionable file and download Verity from Modrinth or CurseForge. Verify the hash before installing.
The ThatMob Connection
Verity is made by Varmite, who’s known as ThatMob on YouTube. He’s a content creator who makes Minecraft videos, and Verity is his mod. He posts about it on his YouTube channel and links to Modrinth and CurseForge in video descriptions.
There’s no official website for Verity itself (this site is fan-run — check our about page for disclosure). The official community hub is the Verity Discord, linked from the Modrinth page.
If someone claims to be “the Verity team” or “official Verity support” outside of these channels, be cautious. The mod’s made by one person, not a company.
What About Bedrock Edition?
Official Verity is Java Edition only — Forge 1.20.1 and NeoForge 1.21.1. There’s no official Bedrock version from the developer.
But third-party Bedrock ports do exist. They’re not official, not supported by the developer, and they’re limited by Bedrock’s scripting API — they can’t run the AI dialogue or Ollama integration that makes Verity what it is. The core experience is missing.
If you’re downloading a Bedrock version, you’re on your own. These ports carry the same risks as any unofficial mod: potential malware, no updates, no support. Download at your own risk and verify the file hash if possible.
We cover this in more detail in our Java vs Bedrock comparison and the Bedrock experience story.
The 2026 Safety Landscape
As of August 2026, Verity has been available for some time and has accumulated over a million downloads across Modrinth and CurseForge. With that popularity comes fake sites and reposted files.
The good news: Modrinth and CurseForge both scan uploaded files for malware. If you download from either platform, you’re getting a file that’s been checked. The bad news: fake sites can bypass this by reposting legitimate files with added malware, or by creating completely fake installers.
The hash check is your best defense. It’s quick, it’s reliable, and it works every time. Take the 30 seconds to verify the file before installing.
Tools for Verification
If you want to go beyond basic hash checking, here are some tools:
VirusTotal: Upload the .jar file to virustotal.com and it’ll scan it with 70+ antivirus engines. If any of them flag it, don’t install it.
CurseForge App: The official CurseForge desktop app verifies files automatically. If you use it to install mods, you don’t need to manually check hashes.
Modrinth App: Same deal — the official Modrinth app (called “Modrinth App” or “theseus”) verifies files.
These tools don’t replace the hash check, but they add an extra layer of verification.
Community Verification
The Verity community is active on Discord (discord.gg/f6DpBDVjMq). If you’re unsure about a file or a download source, ask there. Someone can verify the hash or tell you if the source is legit.
You can also check the comments on the Modrinth and CurseForge pages. If other users are reporting issues with a specific version or file, it might be compromised.
Final Checklist
Before installing Verity, run through this checklist:
Downloaded from Modrinth or CurseForge (not a third-party site)
File is a .jar file (not .exe or .zip)
File hash matches the official hash for that version
VirusTotal scan is clean (optional but recommended)
Version number matches what’s on Modrinth/CurseForge
If all five check out, you’re good to install. If any fail, don’t install — delete the file and download from an official source.
More Resources
- How to install Verity — step-by-step installation guide
- What is Verity? — full breakdown of the mod
- Ollama setup — configure local AI mode
- Troubleshooting — fix common issues
Stay safe out there. The mod’s great — just make sure you’re getting the real thing.