All experiences

How tiers work

Each experience is rated on four parts, 0 to 3: immersion and controls, polish and stability, comfort and completeness. 0 is obstructive, 1 has big compromises, 2 is good with limits, 3 is exceptional. Unknown stays unknown, and an experience with an unknown part is Unrated rather than guessed.

Comfort scores the comfort options and how well they work; how intense a game is gets shown separately, so an intense game with good options can still be S. When one or two parts have no evidence yet, the tier is provisional: we score those parts as low as the weakest known part, and a provisional tier is never S.

S needs 3 in immersion, polish and completeness and at least 2 in comfort. A is 2 or better everywhere. B is worth it with compromises. C is experimental. A 0 anywhere is never averaged away.

Tiers rate the VR experience, not the base game. Nothing pays to rank higher. Today's tiers are our preliminary read of the linked press, creator notes and community threads; we haven't play-tested every entry ourselves, and each mod page shows its evidence.

Where the facts come from

Every version, date, path and link comes from the creator's page (GitHub, Nexus, Thunderstore or their own site), checked in October 2026. When a creator doesn't publish something, we say so instead of guessing. Game artwork is Steam's public store art.

How download security checks work (experimental)

This is an early, experimental feature. It covers a handful of mods we picked to try it out, including both S-tier mods, and it may change or miss things. Don't rely on it yet.

Mods are usually downloaded from a creator's GitHub page. If someone breaks into a creator's account, they can quietly swap a download for malware. Security people call this a supply chain attack. These checks look for the signs of one.

Every night an automatic, public check downloads the latest release of each mod on our list. It never runs or opens the files. It saves each file's fingerprint (a SHA-256 hash: a code that changes if even one byte of the file does) and looks at where the file came from, much like the Python package site PyPI does for its packages.

The badge is one of these:

• Verified source: GitHub signed a record proving each file was built from the creator's public code. The record is kept in a public signing log.
• Built by GitHub: GitHub's build system uploaded the files, not a person, but there's no signed record.
• Watched for changes: the creator uploaded the files by hand, so all we can promise is that we'll notice if one is swapped.
• File changed: a file changed after it was released, or a check failed. That's the classic sign of a hacked account. It stays flagged until a person looks into it.
• From Steam or Not checked: Steam delivers the files, or the creator hosts them somewhere we can't check yet.

We also note whether the release is locked so its files can't be swapped, whether the creator signed the code, the project's independent security score from OpenSSF Scorecard, and whether the release is brand new. A person reviews each night's results before they reach this site.

What these checks can't tell you: whether the mod's own code is harmless. A genuine file from a creator with bad intentions is still bad, and tools like UEVR look like malware to antivirus software because of how they hook into games. Download only from the creator's official page.