diff --git a/.gitignore b/.gitignore
index 56129e7..d6d4cf1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,6 +7,8 @@
 /include/*
 !/include/.placeholder
 
+.download_cache
+
 .localenv.bashrc
 
 # ignore endianness check
diff --git a/scripts/clean_dependencies.sh b/scripts/clean_dependencies.sh
index 697183c..25b4285 100755
--- a/scripts/clean_dependencies.sh
+++ b/scripts/clean_dependencies.sh
@@ -15,6 +15,23 @@
 # version 3 along with this program.
 # If not, see https://www.gnu.org/licenses/agpl-3.0.en.html
 
+echo "Checking download cache for unneeded or corrupted files..."
+for file in $(ls .download_cache); do
+    #TODO: remove if unknown shasum
+    if grep $file scripts/setup_project.sh >/dev/null 2>&1; then
+        if sha256sum --check <<< "$file *.download_cache/$file" >/dev/null 2>&1; then
+            echo -n "."
+        else
+            echo -n "!"
+            rm ".download_cache/$file"
+        fi
+    else
+        echo -n "x"
+        rm ".download_cache/$file"
+    fi
+done
+echo ""
+
 rm -rv ./dependencies
 mkdir -v ./dependencies
 set -v
diff --git a/scripts/setup_project.sh b/scripts/setup_project.sh
index 0241d0d..f01d11d 100755
--- a/scripts/setup_project.sh
+++ b/scripts/setup_project.sh
@@ -32,21 +32,41 @@ fi
 function download {
     URL="$1"
     DESTINATION="$2"
-    SHA256SUM="$3 *$2"
-    echo -n "Downloading $URL to $DESTINATION... "
-    if [ $USE_WGET = yes ]; then
-        wget -O "$DESTINATION" "$URL" >/dev/null 2>&1
-    else
-        curl -L "$URL" --output "$DESTINATION" >/dev/null 2>&1
+    SHA256SUM="$3"
+
+    if [ ! -d .download_cache ]; then
+        echo "Cache directory missing."
+        mkdir -v .download_cache
     fi
-    if sha256sum --check <<< $SHA256SUM >/dev/null 2>&1; then
-        echo "done."
-        return 0
+
+    if [ -f ".download_cache/$SHA256SUM" ]; then
+        if sha256sum --check <<< "$SHA256SUM *.download_cache/$SHA256SUM" >/dev/null 2>&1; then
+            echo "Using locally cached file for $DESTINATION"
+            cp ".download_cache/$SHA256SUM" "$DESTINATION"
+            return 0
+        else
+            echo "Locally cached file for $DESTINATION is corrupted."
+            rm ".download_cache/$SHA256SUM"
+            download "$URL" "$DESTINATION" "$SHA256SUM"
+            return $?
+        fi
     else
-        echo "error."
-        echo "Checksum verification failed. Your download is either corrupted or the file has been altered."
-        rm -v "$DESTINATION"
-        return 1
+        echo -n "Downloading $URL to $DESTINATION... "
+        if [ $USE_WGET = yes ]; then
+            wget -O ".download_cache/$SHA256SUM" "$URL" >/dev/null 2>&1
+        else
+            curl -L "$URL" --output ".download_cache/$SHA256SUM" >/dev/null 2>&1
+        fi
+        if sha256sum --check <<< "$SHA256SUM *.download_cache/$SHA256SUM" >/dev/null 2>&1; then
+            cp ".download_cache/$SHA256SUM" "$DESTINATION"
+            echo "done."
+            return 0
+        else
+            echo "error."
+            echo "Checksum verification failed. Your download is either corrupted or the file has been altered. Removing file."
+            rm ".download_cache/$SHA256SUM"
+            return 1
+        fi
     fi
 }
 
@@ -59,11 +79,6 @@ set -e # failures are not acceptable here
 mkdir -v dependencies/tmp
 download https://github.com/DuffsDevice/tiny-utf8/archive/refs/tags/v4.4.3.tar.gz dependencies/tmp/tiny-utf8.tar.gz 8e3f61651909c9f3105d3501932a96aa65733127fb6e7cf94cb1b0a2dff42c8f
 download https://github.com/fpagliughi/sockpp/archive/refs/tags/v0.7.1.tar.gz dependencies/tmp/sockpp.tar.gz 2e023528bebbd2ac083fc91fbe6d5c4158c3336bedbcff48f594f3b28f53b940
-#TODO: keep the files somewhere else as a cache and only download the ones
-#      we don't have or that got corrupted
-#TODO: once we cache files properly, have clean_dependencies.sh prune
-#      unknown files from the cache (for example old versions
-#      of dependencies)
 
 echo -n "Extracting tiny-utf8... "
 gzip -d dependencies/tmp/tiny-utf8.tar.gz