Is NeoForge Safe? What You Need to Know in 2026

Yes, NeoForge is safe. It is an open source Minecraft mod loader forked from Minecraft Forge in July 2023, and almost all of the original Forge team moved to it. It is not malware, not a virus, and not a sketchy third party tool. The real risks are fake download sites and the mods you put on top of it, and both are easy to avoid.

What Is NeoForge?

NeoForge is a mod loader for Minecraft Java Edition. If you have used Forge before, NeoForge will feel familiar, because it started as a fork of the Forge project. The NeoForged project went public on 12 July 2023, and in the announcement cpw wrote that almost all of the original Forge team had joined, "with one obvious exception, LexManos". The team's own review of 2023 names disagreements between the team and Forge's management as the most obvious reason for the fork.

Forge carried on as a separate project, and it did not stop. On 31 October 2026 both loaders have builds for the newest Minecraft release, 26.3: NeoForge 26.3.0.100 and Forge 66.1.2, the latter from 29 October 2026.

NeoForge lets you install and run mods the same way Forge does. You install it, point your launcher at it, and drop mods into the mods folder. Where the two loaders really differ is which mods support them. On Minecraft 1.21.1, Create publishes its files on Modrinth for NeoForge only, and Jade, FerriteCore and ModernFix have NeoForge and Fabric files but none for Forge. JEI still publishes a Forge, a NeoForge and a Fabric file. Our Forge vs NeoForge comparison explains which mods load on which loader.

Who Maintains NeoForge?

NeoForge is maintained by the NeoForged team. The public members of its GitHub organization include cpw and sciwhiz12, who both have commits in the Forge repository as well, cpw more than 2,300 of them. The code is licensed under the LGPL 2.1 and development happens in the open: pull requests, issues and decisions are publicly visible.

This matters for safety. When the people behind a mod loader are known and the code is public, anyone can check what goes into a build. Open code does not rule out bugs, but it makes it hard to hide something malicious in an official release.

NeoForge Fixes Its Security Bugs in the Open

Safe does not mean bug free. On 15 October 2026 NeoForged published three security advisories on GitHub, all rated medium. Each one describes a way for a player who is logged in to a server to fill its memory with crafted network packets and crash it. The fixes are in NeoForge 21.1.262 for Minecraft 1.21.1, 26.3.0.83 for Minecraft 26.3, and matching builds for the other supported versions.

If your server runs an older build, update NeoForge, or the modpack's server files, when you can. The advisories also point out that these attacks need an authenticated Minecraft account, so a whitelist that limits a private server to people you trust limits the risk.

How to Verify You Downloaded the Real NeoForge

The biggest actual risk is not NeoForge itself. It is downloading a fake version from a scam site. Here is how to make sure you have the real thing:

1. Download from the official site only. The official NeoForge site is neoforged.net. Bookmark it, or type the address yourself instead of clicking a search ad
2. Use a trusted launcher. Prism Launcher, the CurseForge app and the Modrinth app all support NeoForge, as NeoForged noted in its review of 2023, and they install it for you. That way you never handle an installer file from a random site
3. Check file hashes. NeoForge publishes checksums for its installer files. If you download manually, compare the SHA-256 hash of your downloaded file against the .sha256 file that sits next to each installer on maven.neoforged.net (how to check it)
4. Avoid reupload sites. If a site is offering NeoForge as a zip file on Mediafire, Google Drive, or some random download portal, do not use it. The official installer is distributed through neoforged.net and its maven at maven.neoforged.net

NeoForge vs Forge: Safety Comparison

Both NeoForge and Forge are legitimate, open source mod loaders. The 2023 fractureiser malware did not come through either of them: it was hidden in mods and plugins uploaded to CurseForge and BukkitDev. The practical difference in 2026 is release pace and mod support. NeoForged publishes far more builds, 96 for Minecraft 26.3 against 15 from Forge when we counted both projects' maven servers on 31 October 2026, and on 1.21.1 big mods such as Create ship only for NeoForge. Forge is not abandoned, though: it ships builds for new Minecraft releases and still updates 1.20.1.

If you are starting a new modded world on Minecraft 1.21.1 or later, NeoForge is the practical choice because more of the big mods target it. For 1.20.1, NeoForged's own review says development effort on that version is "better spent on Forge rather than NeoForge", and for 1.18.2, 1.16.5 or 1.12.2 there is no NeoForge at all, so a Forge pack for those versions stays on Forge.

Why Does My Antivirus Flag NeoForge?

This is one of the most common reasons people search "is NeoForge a virus." Antivirus software sometimes flags NeoForge's installer. Here is why:

Antivirus engines also use heuristics. Besides lists of known malware, antivirus engines use heuristic rules that judge a file by what it could do. VirusTotal, which checks files with over 70 antivirus scanners, lists both kinds among its tools and notes that harmless items are sometimes detected as malicious by one or more scanners. NeoForge's installer is a Java program packed in a .jar file, so it is an executable like any other. The same applies to the installers of other mod loaders.

The installer changes your Minecraft folder. The client installer looks for your Minecraft launcher profile, writes NeoForge's files into the versions and libraries folders, downloads libraries and adds a NeoForge profile to the launcher, as you can read in the installer's source code. That is normal for a mod loader, but to a security tool it is a program that downloads files and edits another program's settings.

SmartScreen warnings on Windows. Microsoft Defender SmartScreen checks downloaded files against a list of files that are well known and downloaded frequently, and shows a warning when a file is not on that list. A SmartScreen warning on its own tells you the file has no reputation yet, not that it is harmful.

If your antivirus flags NeoForge, first check that you downloaded it from neoforged.net or maven.neoforged.net and that its SHA-256 hash matches the .sha256 file. Only then add an exception for the file. You can also upload it to VirusTotal: the report shows which engines flag the file and the label each one gives it, which helps you tell a generic heuristic hit from a known threat.

Where to Get Mods Safely for NeoForge

NeoForge itself is just the loader. The mods you install on top of it are where you need to stay careful. Stick to these two platforms:

Modrinth (modrinth.com): moderators review each new project before it goes public, and the code behind the site and the app is public on GitHub. Its search can filter by loader and Minecraft version. Review is not a guarantee, though: in May 2024 Modrinth disclosed a mod that was approved with one clean file and received malware in later versions.

CurseForge (curseforge.com): since the fractureiser incident, every Minecraft mod file uploaded to CurseForge goes through an automated check that decompiles it, compares it with known malicious files and runs it through static analysis. Files that look risky are rejected or sent to a person for manual review, as CurseForge describes in Our Mod Approval Process (May 2024).

Our guides on Modrinth and CurseForge safety go into what each platform checks and what it misses.

Do not download mods from random websites, Discord servers, or reupload portals. Even if someone shares a "working mod" in a Discord channel, download it from Modrinth or CurseForge instead. The extra 30 seconds could save you from a compromised file.

FAQ

Is NeoForge safe to use? Yes. NeoForge is open source, maintained by known developers, and publishes its security fixes in the open. Download it from neoforged.net or through a trusted launcher, and keep it updated.

Is NeoForge a virus? No. NeoForge is a legitimate, open source Minecraft mod loader. An antivirus warning on its installer does not by itself mean malware: check where the file came from and compare its SHA-256 hash with the official .sha256 file.

Is NeoForge safer than Forge? Neither is safer by design. Both are open source loaders from known teams, and both put a .sha256 file next to every installer. What matters more is where you download the loader and that you keep it updated.

Can NeoForge mods have viruses? Any code you run can theoretically be malicious. Download mods only from Modrinth or CurseForge, check download counts, and prefer mods with public source code.

Should I switch from Forge to NeoForge? For a new server on Minecraft 1.21.1 or newer, yes: big mods such as Create publish their 1.21.1 files for NeoForge only. For a 1.20.1 pack, stay on Forge, which NeoForged itself recommends for that version. NeoForge has no builds at all for 1.18.2 and older.

Is the NeoForge installer safe? Yes, when downloaded from neoforged.net or maven.neoforged.net and its hash matches the .sha256 file next to it. Do not download the installer from third party sites.

Why did NeoForge split from Forge? In July 2023 almost the whole Forge team left to start NeoForged, after disagreements between the team and Forge's management, according to NeoForged's own account. LexManos stayed with Forge, which still releases builds for new Minecraft versions.

Running a Modded NeoForge Server?

If you are setting up a NeoForge server for your friends or community, Space-Node's Minecraft hosting installs Paper, Forge, Fabric, NeoForge and popular modpacks from the panel in a few clicks, with NVMe storage and a free .mymcserver.nl subdomain.

Related: Is Modrinth Safe?, Is CurseForge Safe?, Is Prism Launcher Safe?

Sources

All opened on 31 October 2026:

• NeoForged: What is happening? (13 July 2023), 2023: The Good, The Bad... and The Fork, security advisories (15 October 2026), GitHub organization members, NeoForge licence, client installer source
• NeoForged maven: NeoForge versions, NeoForge 1.20.1 builds, checksum of installer 21.1.265
• Forge: promotions, maven versions, checksum of installer 1.20.1-47.4.28, licence, contributors
• Modrinth version lists: Create, Jade, FerriteCore, ModernFix, JEI; Modrinth: Windows Borderless disclosure, search API facets, project review fields, source code
• CurseForge: Our Mod Approval Process
• fractureiser investigation
• VirusTotal: How it works
• Microsoft: Microsoft Defender SmartScreen overview