Is this download safe?

Short answer: yes. The free Harbor Engine Sandbox is a folder of ordinary web pages that open in the browser you already have. This page explains exactly what is inside, so anyone (you, a parent, a teacher, or an IT or security team) can check it.

What it is

• A single zip, harbor-engine-sandbox.zip (165 KB, version 2026.10.15), the same file for every computer.
• Inside: HTML, CSS and JavaScript files, one SVG logo, a README text file, and sample HL7 message files made up for practice. Nothing else.
• No installer, no app, no executable, no script to run (.exe, .msi, .app, .dmg, .pkg, .bat, .cmd, .ps1, .sh, .command, .vbs, .jar), no Office macros, no nested archives, no password-protected files, no WebAssembly, no browser extension, no service worker.
• No admin rights needed. You unzip it and open sandbox/index.html.
• The JavaScript is plain, readable source: not minified, packed or obfuscated, and it never uses eval or new Function.

No network, no data leaves the device

• Every page in the zip carries a Content-Security-Policy that the browser enforces:

  default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'none'; worker-src blob:; frame-src 'none'; object-src 'none'; media-src 'none'; manifest-src 'none'; base-uri 'none'; form-action 'none'

  connect-src 'none' means the pages cannot send or fetch anything over the network. There are no external fonts, CDNs, analytics, trackers or update checks.
• Links to our website (for example "Pricing") only open when you click them, in a normal browser tab.
• Our automated tests open every page offline and fail if any network request is attempted.
• Files you open in the viewers are read by the browser on your computer and are never uploaded.

Where it stores things, and how to clear them

The Sandbox saves your practice work in the browser's localStorage for the page's file location (key names start with iha_he_sandbox and hl7b_). It does not use cookies, IndexedDB or the file system, and it writes nothing outside the browser except files you choose to save (exports go to your Downloads folder like any download).

• To clear it: delete the browser's site data for local files (Chrome/Edge: Settings → Privacy → Delete browsing data → "Cookies and other site data"; Firefox: Settings → Privacy → Cookies and Site Data → Clear Data; Safari: Settings → Privacy → Manage Website Data), or use "Reset Harbor Engine" in the Sandbox Settings.
• To remove it completely: delete the unzipped folder and the zip. There is nothing installed to uninstall.

How to verify the file

SHA-256 of harbor-engine-sandbox.zip:

fd7096dde1fd7e194f317d54dbda3a79511bfe06f954f68e803aab39a5743543

The result must match the value above exactly. You can also look the hash up (without uploading anything) on a public malware database, or scan the zip with your own antivirus. We scan each release with ClamAV before publishing.

The file is served only from this site over HTTPS as application/zip, with the same name and size every time. The download starts only when you click the button; nothing downloads by itself.

If your browser, school or company blocks it

• Some managed laptops block all .zip downloads or all local HTML files. That is a general policy, not a finding about this file. Ask your IT team to review this page; everything they need is here.
• You can also use the browser version without downloading anything (it is the same engine, served from this site).

Files in the zip

Questions? Use the Feedback button on any page of this site.