How to check a download is genuine: checksums and signatures

Before you install privacy software, a crypto wallet or an operating system, it is worth checking the file is exactly what its makers published. Attackers set up fake download sites and hack real ones to swap in malware, especially for wallets and privacy tools.

There are two ways to check, and many projects offer both.

1. Checksums: is the file unchanged?

A checksum (or hash) is a fingerprint of a file, like SHA-256: 3f1a…. If one bit of the file changes, the fingerprint is completely different.

1. Find the checksum on the project's official website (for example next to the download link).
2. Open our File Checksum Checker, choose the downloaded file and SHA-256.
3. Paste the official checksum. It tells you if they match.

The catch: if attackers control the download page, they can change the checksum too. A checksum proves the download was not damaged, and is strong when you get the checksum from a different, trusted place (for example the project's GitHub as well as its website).

2. Signatures: did it really come from the makers?

A digital signature proves who made a file. The developers sign it with their private key, and anyone can check it with their public key. An attacker cannot make a valid signature without the developers' private key.

1. Download the file and its signature file (often ending in .sig or .asc).
2. Get the developers' public key from a trusted source, and check its fingerprint against several places (their website, GitHub, social accounts).
3. Verify:
   • On a computer with GnuPG: gpg --import key.asc, then gpg --verify file.sig file. Look for Good signature from the expected name, and check the key fingerprint matches.
   • On Android: use OpenKeychain (see how to use OpenKeychain).

3. Android apps: check the signing certificate

Every Android app is signed. Once installed, Android only accepts updates signed with the same key. To check the first install:

• Download apps from F-Droid or Aurora Store, or the developer's own site, never from random mirror sites. See how to download apps safely.
• AppVerifier (in the GrapheneOS App Store and Accrescent) compares an app's signing certificate with the one the developer publishes.

Good habits

• Type the official address yourself, or use a bookmark. Do not trust download links in ads, search ads or messages.
• Be extra careful with crypto wallets: check the signature every time you download one.
• If a check fails, do not install it. Delete the file and download it again from the official site.