balenaEtcher
balena-io/etcherReviewed by AI
What it does
balenaEtcher copies a downloaded operating system image (a .iso or .img file, such as Raspberry Pi OS or a Linux install disc) onto a USB stick or SD card. You pick the file, pick the drive and press Flash; it hides your internal disks from the list and verifies the written data afterwards. It can also write directly to Raspberry Pi boards that support USB device boot mode. It is for anyone, with ready installers for Windows 10 and later, macOS 10.13 and later and most 64-bit Linux distributions.
How easy it is to install
A · download and open · Windows
- Windows A
- macOS A
- Linux A
Every release carries a ready installer for each system: balenaEtcher-2.1.9.Setup.exe (262 MB) for Windows, .dmg files for Intel and Apple Silicon Macs, and .deb, .rpm and zip builds for Linux, plus winget, Chocolatey and AUR packages. You open it and use the window; nothing else has to be installed.
Numbers on GitHub
- Stars
- 34,628on Oct 31, 2026
- Downloads
- 318,330,628365,339 this week
- Growth
- +30stars in 5 days
Stars over time
Facts
- Runs on
- Windows, macOS, Linux
- You need to install
- Nothing extra
- To build from source
- Node.js
- Disk space
- 262 MB–785 MB · from the installer
- Accounts or keys
- None
- Cost
- Free · Free and open source (Apache-2.0). It is made by Balena Ltd, which sells separate paid cloud products; you do not need an account for Etcher.
- License
- Apache-2.0 (Permissive)
- Can replace
- WinToUSB
- Last update
- Oct 22, 2026
Risk signals (4)
- AttentionDependencies with known vulnerabilities
Pinned dependencies with known vulnerabilities (OSV): electron-updater: GHSA-9jxc-qjr9-vjxq; immutable: GHSA-v56q-mh7h-f735, GHSA-wf6x-7x77-mvgw, GHSA-xvcm-6775-5m9r; lodash: GHSA-f23m-r3pf-42rh, GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg; uuid: GHSA-w5hq-g745-h8pq
automatic check
- Infocrash reports to sentry
package.json lists "@sentry/electron": "^4.24.0" among the runtime dependencies, so the app is built to send crash and error reports to a Sentry service run by the publisher.
AI review
- Infoerases the chosen drive and needs admin rights
Writing an image replaces everything on the selected card or stick. The app needs raw access to drives: package.json depends on @ronomon/direct-io, drivelist and mountutils, requires a polkit authentication agent on Debian systems, and ships winusb-driver-generator on Windows. The project says it blocks your internal hard drives from the list.
AI review
- Infoupdates itself
package.json depends on electron-updater 6.1.8, so the installed app can download and apply its own updates. The deterministic checks list a known vulnerability advisory for that exact pinned version.
AI review
Evidence is shown in its original language.
What Radar could not check
- Whether a given image file and a given card or card reader really work together
- What the crash reports contain, for example file names or drive models, and whether they can be turned off
- How long a write takes, which depends on the card and the USB port
- Whether the Raspberry Pi USB device boot flashing works on your board
- How much space the installed app takes after unpacking (the installers are 118-271 MB)