Is Modrinth Safe? Mod Downloads, Malware Risk and Rules (2026)

If your child, or you, wants to add mods to Minecraft, you've probably been told to use Modrinth. That's reasonable, but a trusted site isn't the same as a safe file every time. I've read Modrinth's own terms, privacy policy, content rules and security notice, plus what Wikipedia records about mod malware, so you know what is and isn't promised.

Who runs Modrinth

The privacy policy says Modrinth is part of Rinth, Inc., and its terms name Rinth, Inc. as the operator, with an address in Tempe, Arizona. So there's a named US company behind it rather than an anonymous upload page.

According to Wikipedia's article on Minecraft modding, mods are shared through repositories like CurseForge and Modrinth, and Mojang doesn't provide an official modding API. In other words, Modrinth isn't made by Minecraft's developer; it's an independent place where creators publish mods.

What Modrinth does and doesn't promise about files

This is the line that matters most. Modrinth's terms say it can't promise that files available for downloading are virus-free, and they tell users to run their own anti-virus protection. Most download sites say something similar, but it's worth reading it rather than assuming a big name means a clean file.

The terms also say the person who uploads content is responsible for it. So treat each mod as the work of an individual creator who may or may not be careful.

What I checked	What Modrinth's pages say
Who operates it?	Rinth, Inc., with a Tempe, Arizona address in its terms
Are files promised virus-free?	No, the terms say it can't guarantee that
Minimum age?	13 or older, per the terms
Can you report a bad project?	Yes, with the Report button or by email to support
Does it sell your data?	Its privacy policy says it doesn't sell any data

Modrinth's content rules and reporting

Modrinth publishes content rules that ban content that is harmful, damaging or disruptive. They also ban content designed to upload data to a remote server without clear disclosure, and client mods advertised as cheats or hacks. Projects that rely on generative AI must carry a disclosure.

If you find something wrong, the rules say to use the Report button on any project, version or user page, or email support. The rules don't describe the review process in detail, so I can't tell you how thorough checks are. What I can say is that there's a published way to flag trouble, which isn't true of every file site.

Modrinth and the wider problem of mod malware

Modrinth isn't the only mod site, and mod malware has been a real problem across the scene. According to Wikipedia, the Fractureiser malware in 2023 spread through compromised mods and modpacks on CurseForge. In 2017, ESET reported 87 trojan apps disguised as Minecraft mods on the Google Play Store, with over 1,000,000 downloads.

I'm not saying Modrinth was affected by either; those examples show why a mod from any site can carry risk. If a malicious file ever reached your device, it could go after saved logins, so my guides on spotting a hacked account and basic steps to stop hackers are worth keeping handy.

Your privacy on Modrinth

The privacy policy says it doesn't sell any data and doesn't knowingly collect personal information from children under 13. It does collect data such as IP address and the projects you view or download, and it lists PostHog as a third-party analytics service.

If a younger player is using the site, check the age rule in the terms and set up the account together.

How to download from Modrinth more safely

• Use the official Modrinth website or its own app, and type the address yourself.
• Check the creator's page, how long the project has existed and whether the source is linked.
• Be wary of mods that ask for extra files, a separate installer or an off-site link.
• Never download a mod that offers free paid content, cracked items or cheats.
• Keep antivirus on and scan files before running them.
• Report anything suspicious using the Report button.

Mods can also slow a game or crash it, which isn't a security issue but is worth knowing. My piece on playing Android games on a PC without lag covers the performance side of gaming setups.

Spotting fake Modrinth sites and messages

Because Modrinth is popular with young players, copycats target it. Watch for sites with a slightly different address, Discord messages offering a mod pack, and videos with a download link in the description.

• Modrinth won't ask for your password or verification codes by message.
• Ignore anyone asking you to run a file they sent you directly.
• Don't pay or send gift cards to get a mod.

My verdict on Modrinth

This looks like a real platform with a named operator, published rules and a reporting route, so I wouldn't call it unsafe by default. But its own terms don't promise files are virus-free, and mod malware has hit the wider scene. Download from the official site, vet each creator, keep antivirus on and treat unknown mods with suspicion.

Frequently asked questions

Who owns Modrinth?

Modrinth's privacy policy says it's part of Rinth, Inc., and its terms name Rinth, Inc. as the operator.

Does Modrinth guarantee mods are virus-free?

No. Its terms say it can't promise that downloadable files are virus-free and tell users to run their own anti-virus protection.

What age do you need to be to use Modrinth?

Its terms say the service is offered to users who are 13 years of age or older.

How do I report a bad mod on Modrinth?

Its content rules say to use the Report button on any project, version or user page, or email support.

Does Modrinth sell my data?

Its privacy policy says it doesn't sell any data, though it collects details like IP address and the projects you view or download.