Short answer: the genuine BetterJoy — the one from Davidobot’s GitHub repository — is about as auditable as Windows software gets: MIT-licensed, source fully public, and shipped as a plain ZIP you can hash-check before you run anything. The danger in this corner of the internet was never really the program; it is the crowd of repack sites, wrapper installers and “updated versions” that borrow its name. This guide gives you the three checks that separate the two: source, hash, and behaviour. If you only do one of them, do the hash.
Why the real BetterJoy is auditable
BetterJoy is open-source software under the MIT License (copyright David Khachaturov, the developer known as Davidobot). Anyone can read the complete source code in the official repository, and the program’s design matches what the code suggests: it is a local mapper. You run it on your machine, it reads your controller, it exposes virtual XInput or DualShock 4 devices through the ViGEmBus driver, and it serves motion data through a UDP server that binds to localhost (127.0.0.1:26760) by default — your own machine talking to your own emulators. There is no account, no sign-in, nothing to register. We phrase the network point carefully, because honesty cuts both ways: what we can verify is that it is a local utility whose motion server listens on the loopback address; we won’t dress that up as a forensic audit, and you don’t need one — the hash check below is stronger than any promise.
Check 1: the source is GitHub, full stop
The only official distribution channel for BetterJoy is the Releases tab of github.com/Davidobot/BetterJoy. Our download page links straight to that release asset, and our GitHub guide shows how to recognise the real repository and why lookalike sites are a red flag. If a page offers you BetterJoy through a custom “installer,” a downloader stub, or a setup wizard with bundled offers, close it: the genuine article is a single ZIP with the executable inside, no installer at all.
Check 2: verify the SHA-256 hash (2 minutes)
GitHub’s older BetterJoy releases predate published per-asset digests, so we measured the genuine file ourselves by downloading it from the official release. For BetterJoy_v7.1.zip (the only asset of the v7.1 release, 4,438,028 bytes):
SHA-256: a9ffe5bb14b05e775f34f9eeff41fca89a350d49252eedae1e330e88952e7f36
To check your copy in Windows PowerShell:
- Download the ZIP, but don’t extract it yet.
- Open the folder in File Explorer, click the address bar, type
powershelland press Enter. - Run:
Get-FileHash .\BetterJoy_v7.1.zip -Algorithm SHA256 - Compare the output, character for character, with the value above. Also right-click the file → Properties and confirm the size is 4,438,028 bytes.
A matching hash proves your file is bit-for-bit the file the author published — no wrapper, no additions, no “enhancements.” A mismatch means delete it and re-download from the official release. This single habit makes almost every other scare story about BetterJoy irrelevant.
Why antivirus sometimes complains anyway
BetterJoy installs and talks to kernel-level driver components: ViGEmBus creates virtual gamepads, and the bundled legacy HIDGuardian can hide your physical controller from other programs so only the virtual one is seen. To a heuristic antivirus engine, “a small unsigned-looking utility that installs a bus driver and hides HID devices” resembles the shape of genuinely bad software, even when every byte is accounted for. Add the fact that the executable is a 2021 build that SmartScreen has limited reputation data for, and an occasional warning is expected behaviour — not proof of infection, and not something a legitimate site should tell you to “just disable your antivirus” over. The correct response to a warning is the hash check above, not blind trust in either direction. If the hash matches the official release, the warning is about the category of tool, not about your file.
The real risks: everything around the program
- Fake installer sites. Pages advertising “BetterJoy v8” or “v9” as Davidobot’s new official release are mislabelling the community fork or inventing a product; the official line ends at v7.1 (see the version history).
- Repacks and “portable” bundles from file-hosting forums: unhashable by definition. If it doesn’t match the SHA-256, it isn’t BetterJoy as published.
- Driver download scams. ViGEmBus and HidHide have their own official sources (Nefarius on GitHub). “Driver updater” sites that bundle them are a classic malware channel — our download page links the official driver release directly.
- Switch 2 bait. Any page offering a “BetterJoy for Switch 2 controllers” download is selling something that does not exist; we explain why in the Switch 2 answer.
And what about this site?
Fair question, answered the same way we’d want it answered: we are an unofficial resource, not the author. Our download page’s primary button is the official GitHub release asset itself, the alternative mirror is labelled as a mirror in plain text, and the SHA-256 printed there is the one in this guide, measured from the official file. You don’t have to trust any of that — that’s the point of a hash. Verify it once and every claim on this page becomes checkable rather than rhetorical.
Frequently asked questions
Is BetterJoy a virus?
No. The genuine release is open-source (MIT), publicly auditable, and verifiable with the SHA-256 above. Antivirus warnings target its driver-level behaviour — virtual gamepads and device hiding — which resembles malicious tooling in shape, not in fact.
Is it safe to install the bundled drivers?
ViGEmBus is a widely used, signed virtual-gamepad driver; the copy inside the v7.1 ZIP is an older build, which is why our download page also links the final ViGEmBus 1.22.0 from its author’s GitHub. The legacy HIDGuardian is discontinued in favour of HidHide — they must never coexist; our double-input guide covers the modern setup, and the uninstall guide removes everything cleanly if you change your mind.
Does BetterJoy collect my data?
It has no accounts and no sign-in, and it is a local mapping utility whose source anyone can read. Beyond that verifiable description we make no claims we can’t back — and neither should anyone else.
For the full trust picture — history, fork, and source-checking — start at the Versions & Trust hub.