Check Minecraft mods for RATs before you launch them.

Drop a .jar into the list below. RatChecker reads its bytecode on your device and shows what the mod really does: token theft, webhooks, downloads that run programs. The mod is never run and never uploaded.

Download for Windows Free. Windows 10 and 11. Works for Fabric, Quilt, Forge and NeoForge.

Scanner

Same rules as the app. Click a row to see what was found.

Check Modrinth Add .jar

Drop .jar files hereNested jars, encoded strings and known RAT signatures are all checked. Nothing is executed.

Checked on this device. The only thing sent anywhere is the file's SHA-1, to Modrinth, to see if it is the real published file. No scanner catches everything, so don't treat a clean result as a promise.

See it in one minute

A mod someone sends you, what it hides, how Guard stops it, and what the app shows you.

Plays from YouTube. Nothing loads from YouTube until you press play.

What a report shows

This is RatChecker's report for one of its test samples, a fake "free cosmetics" mod. Every finding points to the class and line that triggered it, and hidden strings are shown decoded.

FreeCosmetics-2.0.jarMalicious

3 KB · Fabric 1.20.1 · 9 classes · 0 nested jars

Not on Modrinth, and its mod id doesn't match any Modrinth project.

RISK SCORE

93 / 100

The Windows app

The browser check only sees the jars you drop in. The app sits in the tray and checks mods as they arrive. These are its real settings.

Scan downloads

Every .jar that lands in Downloads is checked right away, and you get a notification if it is risky.

When a RAT is found

It is held so it cannot load, and you choose: delete it, keep it in quarantine, or load it anyway.

Stop the game for risky mods

Start Minecraft with a risky mod and the game is paused until you decide.

Check where mods come from

Compares each jar with the file published on Modrinth, so a fake Sodium or Iris gets caught.

Decompiler

The jar's folder tree, like a normal decompiler, with the flagged lines highlighted and hidden strings decoded in place.

Explain with AI

Off by default. Sends the findings, never the jar. Runs free and offline with Ollama, or with your own NVIDIA key.

PC Check

Looks for what a RAT leaves behind on Windows: autostart entries, scheduled tasks, dropped jars.

The RatChecker app's decompiler: the jar's folder tree on the left, decompiled code with the flagged lines highlighted on the right — This is the real app running with sample data. Click around.

RatChecker for Windows

File: RatChecker-setup.exe
Needs: Windows 10 or 11, 64-bit. Java is included.
Price: Free. No account, no ads.
Checksum: SHA-256 of the installer, to check your download.
Windows: The installer isn't code-signed yet, so Windows may say "Windows protected your PC". Click More info, then Run anyway.

Download for Windows

Questions

Is my mod uploaded?: No. The check runs in your browser. Only the file's SHA-1 hash goes to Modrinth, so it can say whether this is the real file. Switch off "Check Modrinth" to skip that too.
Does Clean mean safe?: It means nothing known was found. New or well-hidden malware can get past any scanner, and a safe mod can get flagged for doing unusual things. Get mods from Modrinth or CurseForge, and be careful with jars people send you on Discord.
A mod I trust got flagged: Some real mods download updates or start programs, which RATs also do. Open the row to see what was found and where. In the app you can mark it as safe and it won't ask again.
Why does Windows warn me?: Windows shows "Windows protected your PC" for programs that aren't signed with a paid certificate yet, and RatChecker isn't. It doesn't mean Windows found anything. Click More info, then Run anyway. Only download RatChecker from this website.
I already ran a bad mod: Run PC Check in the app. From another device, change your Microsoft, Discord and email passwords, sign out of all sessions, and turn on two-factor login.