Buyer's guide · checked 19 October 2026

Poker bot download: what you actually get, and how to check it before you run it

Searching for a poker bot download mostly finds free poker games. On 19 October 2026 I ran four download-style queries on Bing and read every result: 37 listings, and not one was a bot vendor's download page. The bot builds people do end up running come from somewhere else (forum threads, chat groups, file-sharing links), and that is where the risk sits.

Updated 19 October 2026. One Bing session without a login, one GitHub API query. Results move, so treat the counts as a dated snapshot. I did not check Google.

What four download searches returned

I typed each phrase into Bing as written, without logging in, and logged the rank and the domain of every organic result. Then I sorted each listing into bot vendor or download page, open-source repository, forum or review, free poker game, or something else. I opened nothing that looked like an installer.

That is 37 listings and 17 distinct URLs. The odd one out is the second query, where Bing dropped to seven results and filled them with the word "download" alone. Nobody who types it gets the poker half of the sentence answered.

A vendor that wanted to be found for "download" would have to show up here, and none did. People who run a bot build mostly got the link from a person, a thread or a channel. A link passed along that way has no domain history, no support page and no reason to be what the sender says it is.

What GitHub holds under "poker bot"

The GitHub downloads are source code. I ran its repository search for "poker bot" the same day: 2,259 repositories match. I read the descriptions of the ten with the most stars.

None of the ten ships a ready-to-run installer. Licenses: four MIT, one Apache-2.0, one marked "no assertion", four with none stated, which means you cannot assume you may reuse that code. You compile or run these yourself, and nothing in them points at a real-money table except the last row. If you came for a program to double-click, GitHub is not that.

Where real bot builds come from

• A vendor build behind a license. The download link arrives after payment or after a trial sign-up. You get a version number, an order ID, someone to write to, and usually an update channel. It still needs checking, but there is a counterparty.
• A free or "cracked" copy. It sits on a forum, in a chat group or in a video description. A bot reads your screen, drives the mouse and keeps running, so a trojan inside one gets the same access with no one to question it. Those builds go after browser cookies, wallet files, and room sessions.
• Source code. You build it and read the source yourself, so you own whatever it does. Fine for learning. Few readers will audit tens of thousands of lines before the first run.
• A free poker game. What the search engine hands you for any of the phrases above. Harmless, and not a bot.

Three checks I ran, with the output

Before a file ever runs you can look at its hash, at its signature, and at whether the system tagged it as downloaded. I ran them on macOS 26.5.2 against a two-line shell script I wrote for the purpose, with Apple's own Calculator as the signed reference. Nothing here touches a bot or a poker room. The Windows equivalents are Get-FileHash -Algorithm SHA256 and Get-AuthenticodeSignature; I did not run those for this page.

First, the hash. I recorded the SHA-256 of the script, saved it to a file the way a vendor would publish it, and verified. Then I appended one comment line and verified again:

$ shasum -a 256 -c sums.txt
unsigned-demo: OK

$ echo "# x" >> unsigned-demo
$ shasum -a 256 -c sums.txt
unsigned-demo: FAILED
shasum: WARNING: 1 computed checksum did NOT match

One added line, a different hash. The file in front of you is, or is not, byte for byte the file whose hash you hold.

Second, the signature. The same script, then Apple's Calculator:

$ codesign -dv unsigned-demo
unsigned-demo: code object is not signed at all

$ spctl -a -t exec -vv unsigned-demo
unsigned-demo: rejected
source=no usable signature

$ spctl -a -vv /System/Applications/Calculator.app
/System/Applications/Calculator.app: accepted
source=Apple System
origin=Software Signing

Third, the quarantine tag. Browsers mark downloaded files with an attribute that makes the operating system ask before the first launch. I wrote one onto the test script by hand and read it back (com.apple.quarantine: 0081;5f000000;Safari;). A file that arrives without that tag, out of a zip or a chat export, skips the prompt that would have caught it.

What each check proves, and what it does not

A matching hash proves the copy is intact. It does not prove the seller is honest. If the hash sits on the same page as the file, whoever swapped the file swapped the hash too. Get it by a second route, such as a message from the seller, and compare.

A signature names a publisher. Someone with a registered identity signed the file, and it has not changed since. That does not establish whether the publisher deserves trust. An unsigned bot build is the normal case in this niche, so a missing signature is a reason to run the file more carefully and settles nothing alone.

A clean result on a multi-engine scanner like VirusTotal is the weakest of the four. Fresh or repacked builds are what scanners have not seen yet. The reverse holds too: bot software reads the screen and sends input, which is also what some malware does, so honest tools can draw flags. A flag is a question for the seller. A clean result is one more input, and a light one.

Rules for a first run

• Use a throwaway virtual machine or Windows Sandbox with a snapshot, not your daily profile.
• No poker room login, no email session, no wallet in that environment.
• Turn the network off for the first launch. If it refuses to start offline, it may only need a license check, so allow one connection and watch where it goes.
• Compare the hash with a value the seller sent you separately, and write down the version number you received.
• Delete the snapshot afterwards, whatever happened.

Download or license

A download gives you a file. A license also gives you a counterparty, a key tied to a build, an order ID, a receipt or invoice, a refund rule to read before paying, and a place to complain. When only a file is on offer, your accounts are at risk.

We sell licenses here, so apply this to us. The home page says the build you receive is signed and pinned to your key. Ask for the hash and the signer name before paying, over a separate channel, and run the checks above. The longer list of what to settle before money moves is in the buying guide on the home page. For where sellers show up, see the market overview; for what a trial should ask of you, the free-trial check; for what the rooms say about running a bot at all, the does-it-work page.

Short answers

Is there a free poker bot download without risk? Open-source code from GitHub is free and readable, but none of the top ten results I read is a ready-made program for a real-money room. Free compiled builds from forums and chats carry the risk described above.

Is a clean VirusTotal result enough? No. It tells you scanners have not flagged that exact file yet. Combine it with the hash, the signer and a sandbox run.

Do I need to check a file I paid for? Yes. Paying does not change what the file does. The advantage of a paid build is that you can ask the seller for the hash and the signer name.

Will these results stay the same? No. I ran each search once, on one day. Run your own before you trust a number from me.