Feather Client

How we got this result

1. Files checkedWe compare the fingerprint and the content of each file with the malware we and others have found, and look at what is inside it.4 of 4 official filesLast checked on 3 Nov 2026
2. Deep checkOur own tools read the code of each current file and look for what harmful code does, like stealing logins or running hidden programs.3 of 4 official filesLast checked on 3 Nov 2026
3. Warning A Warning in 2 of its 4 official files.Our checks look for known signs of harm. They cannot prove that a file is harmless.

At a glance

Download

Official files for Windows, macOS and Linux, and one file for every system.

Fake sites

7 fake sites found.

Privacy

Sends data. It sends crash reports.

Releases

Version 0.2.0.474 (Dawn).

Source and links

Official site

feathermc.com

Official site

7 sites use its name to give other files. See Fake sites

Download page

dawn.gg/#downloads

Newest version

0.2.0.474 (Dawn)

Account

A Microsoft account that owns Minecraft: Java Edition, says dawn.gg.

Moved to Dawn

Feather's site says Feather was acquired by InPvP and its players are being moved to a new client, Dawn. Its download buttons now lead to dawn.gg.Read on 2 Nov 2026

Ads

The Dawn launcher shows ads and sells optional cosmetics, says dawn.gg.

What we checked

A launcher runs on your computer like any program, and it downloads the game and its mods, so harmful code in it can steal your accounts or files.

Files checkedEach official file is downloaded on a separate machine, opened with every file inside it and never run. ClamAV, a free antivirus, and our YARA rules look for known signs of harm in all of it.

4 of its 4 official files, with every file inside them.Last checked on 3 Nov 2026

Deep checkOur own tools read the Java code in the files and look for what harmful code does, like stealing logins or running hidden programs. They read Java code only.

3 of its 4 official files. 1 hold no Java code: programs made for one system.

SignatureThe name of the company or person that signed the file. A file changed after signing loses its signature.

Signed by InPvP Inc.Our tool could not confirm the certificate chains

What we found

What its Java code can do. None of this is harmful by itself: many launchers and mods do the same.

Warning: Reads the login data of other programs

Reads the login data of other programs (launcher account files).minecraft_accounts

Warning: Names places that start programs at login

Names a place that starts programs when you log in to your computer.

Can connect to the internet

It has code that can go online, for example to check for updates, sign you in or download the game. What it sends is in Privacy.In all 3 files whose Java code we read

Accepts connections from other computers

The code references server sockets or an embedded web server. Used by some tools for local web interfaces, profilers, or LAN features.In 2 of the 3 files whose Java code we read

An archive has a misleading name

A file is a zip or Java class data although its name says otherwise. Some file formats do this on purpose.In 2 of the 3 files whose Java code we read

Can download and run new code

One class references both network APIs and class loading. This is the pattern of auto-updating loaders, but also of some harmful programs. Only the source of the downloaded data tells which.In 2 of the 3 files whose Java code we read

Contains code made for your system

Native libraries (.dll, .so, .dylib) run outside the Java sandbox. Used for speed, compression, audio, graphics or database engines.In 2 of the 3 files whose Java code we read

Creates code while it runs

The code can create or load pieces of code while it runs. Launchers load the game, its mod loaders and their own modules this way.In 2 of the 3 files whose Java code we read

Names files of other programs

Strings in the code name places where other programs keep their files. A launcher can need some of them, for example to find the game or Java.In 2 of the 3 files whose Java code we read

Starts other programs

The code can start another program on your computer. Common reasons: opening a web link or a folder, reading hardware information, launching a helper tool.In 2 of the 3 files whose Java code we read

The evidence4

Each finding of our checks: the file, what it is in plain words, where our tools saw it, and the rule that matched.

• Reads the login data of other programs
  Reads the login data of other programs (launcher account files).In Dawn/Dawn (Feather).app/Contents/app/desktop-desktop-0.2.0.474.jargg.dawn.launcher.desktop.profiles.importing.F minecraft_accounts: string "launcher_accounts.json"Rule: login_store
  Counted as a Warning
• Names places that start programs at login
  Names a place that starts programs when you log in to your computer.In Dawn/Dawn (Feather).app/Contents/app/desktop-desktop-0.2.0.474.jargg.dawn.launcher.desktop.startup.WindowsCurrentUserRunKey Windows Run registry key: string "Software\Microsoft\Windows\CurrentVersion\Run"Rule: persistence
  Counted as a Warning
• Reads the login data of other programs
  Reads the login data of other programs (launcher account files).In sample.tar.x/Dawn (Feather)/lib/app/desktop-desktop-0.2.0.474.jargg.dawn.launcher.desktop.profiles.importing.F minecraft_accounts: string "launcher_accounts.json"Rule: login_store
  Counted as a Warning
• Names places that start programs at login
  Names a place that starts programs when you log in to your computer.In sample.tar.x/Dawn (Feather)/lib/app/desktop-desktop-0.2.0.474.jargg.dawn.launcher.desktop.startup.WindowsCurrentUserRunKey Windows Run registry key: string "Software\Microsoft\Windows\CurrentVersion\Run"Rule: persistence
  Counted as a Warning

What we checked

A launcher can send information about you over the internet, such as your player name or your login.

Deep checkWe read the code and list each web address it can contact, and what it sends. We leave out code that is never used.

The Java code of all 3 files that hold some. See each file in Releases

Web addresses

127.0.0.1: Talks to a program on your own computer.Sends: nothing about youAddress built while it runsThe code builds this address while it runs, so it is not written in the file.: Purpose not known.Sends: nothing about you

Also named in its codeAddresses written in its code that no code we read contacts: a link shown to you, a default setting, or code we could not follow.

api.azul.comapi.dawn.ggapi.minecraftservices.comapi.modrinth.comapi.mojang.comaternos.gmbhaternos.orgauth.xboxlive.combedrockbuddy.comcdn.dawn.ggcdn.paynow.ggchrome-devtools-frontend.appspot.comcmp.inmobi.comdawn.ggdiscord.comdiscord.ggdn0qt3r0xannq.cloudfront.netdocs.sentry.iodummy.exampleelectron-launcher.feathermc.comfeathermc.comfill.papermc.iofixture.r2.cloudflarestorage.comfonts.google.comgithub.comgoo.glei.ytimg.comimg.youtube.cominpvp.netlauncher.mojang.comlibraries.minecraft.netlibs.feathercdn.netlogin.microsoftonline.commaven.minecraftforge.netmaven.neoforged.netmc-heads.netmclo.gsmeta.fabricmc.netmodrinth.comnamemc.compiston-meta.mojang.comrepo.maven.apache.orgsecurepubads.g.doubleclick.netsentry.dawn.ggsentry.iosessionserver.mojang.comsupport.aternos.orguser.auth.xboxlive.comwww.freedesktop.orgwww.youtube-nocookie.comxboxlive.comxsts.auth.xboxlive.comyoutrack.jetbrains.com

How to know the official site

Official site

feathermc.com

Also leads there

feathermc.net sends you to feathermc.com.

Files come from

dawn.gg and cdn.dawn.gg

Signed byThe name of the company or person that signed the file. A file changed after signing loses its signature.

InPvP Inc, on dawn-installer.exe

SHA-256A fingerprint of the file. The same fingerprint means the same file, byte for byte.

dawn-installer.exeebb225fc29374d232f1ca9231ac730e869eed2c5a6306dc07e7f2e3ac4741b23Every official file and its SHA-256, in Releases

The 7 fake sites we foundChecked on 4 Nov 2026

Of these, 3 give a file that is not the official one and 4 no file we could get. Sites in one fold share their pages and their download.

If you downloaded a file from one of these sites

1. Drop the file in the Scanner. It tells you if it is an official file of Feather Client or a file of these sites.
2. If it is not an official file and you have not opened it, delete it.
3. If you opened it: run a full scan with your antivirus. On Windows, the built-in one is Microsoft Defender, in the Windows Security app.
4. If you signed in to the launcher it installed: use "sign out everywhere" in your Microsoft security settings and change your Microsoft account password.
5. Get Feather Client from its official site, feathermc.com .