Last updated: October 28, 2026
To verify a crypto wallet download, compare the file's SHA-256 hash with the one the developer publishes, and check that the hash list is signed with the developer's PGP key — if either doesn't match, delete the file. This takes about five minutes and protects you from fake wallet sites, hacked download mirrors and malware that steals seed phrases. Below are the exact commands for Windows, macOS and Linux, plus where the major wallets publish their hashes and signatures.
- ~5 min to verify a download
- 2 checks: hash + signature
- 64 hex characters in a SHA-256 hash
- 1 wrong character = don't install
Why verify at all?
Fake wallet apps are one of the most common ways people lose crypto. They're pushed through search ads, lookalike domains and copied GitHub pages, and they work exactly like the real wallet — until you enter your seed phrase. Checking the hash proves the file is identical to the one the developer published; checking the signature proves the published hash came from the developer and not from someone who hacked the website. See also fake crypto browser extensions and DNS hijacking.
Step 1 — check the SHA-256 hash
Download the wallet and the developer's hash file (often called SHA256SUMS or hashes.txt) from the official site. Then calculate the hash of your download:
| System | Command |
|---|---|
| Windows | certutil -hashfile wallet-setup.exe SHA256 |
| macOS | shasum -a 256 wallet.dmg |
| Linux | sha256sum wallet.tar.gz |
The 64-character result must match the line for your file in the hash list exactly. Compare the whole string, not just the first and last few characters.
Step 2 — check the PGP signature
- Install GnuPG (Gpg4win on Windows, GPG Suite on macOS, preinstalled on most Linux).
- Import the developer's public key from a source other than the download page if possible — for example their GitHub profile or a long-standing keyserver entry.
- Verify the signed hash list:
gpg --verify SHA256SUMS.asc SHA256SUMS(file names vary). - Look for "Good signature" and check that the key fingerprint matches the one the developer publishes. A "BAD signature" means stop.
Where major wallets publish hashes and signatures
| Wallet | What they publish |
|---|---|
| Monero GUI / CLI | A signed hashes.txt on getmonero.org |
| Feather Wallet | Hashes and PGP signatures on its download page |
| Bitcoin Core | SHA256SUMS signed by multiple independent builders |
| Electrum | A .asc signature for every release file |
| Sparrow | Signed manifest of hashes for each release |
Mobile apps from the official App Store or Google Play are checked by the store, but make sure the developer name is correct — fake wallet apps do slip in. Our picks are in best Monero wallets and best USDT wallets.
Other habits that keep you safe
- Type the official URL or use a trusted bookmark — never a search ad.
- Prefer the developer's own site or official GitHub releases over third-party mirrors.
- Re-verify every update, not just the first install.
- For Monero, verify the wallet and consider running your own node.
- Use a hardware wallet for larger amounts — buy one privately, from the manufacturer.
Frequently asked questions
Is checking the hash enough?
It proves your file matches the published hash. If the website itself was hacked, the hash could be fake too — that's why you also check the PGP signature.
What if the hash doesn't match?
Delete the file and download again from the official site. If it still doesn't match, don't install it and check the developer's announcements for a security notice.
Do I need to verify mobile wallet apps?
Store apps are verified by Apple or Google, but check the developer name and the link from the official website. If you sideload an APK, verify its hash or signature like a desktop file.
Where do I get the developer's PGP key?
From the official site and, ideally, a second independent source such as their GitHub profile. The fingerprints must match.
Do I need to verify a wallet to use an instant exchange?
The exchange doesn't check it, but you should: the wallet holds the keys for the coins you receive. A fake wallet would steal the payout.
Once your wallet is verified, swap without an account on /swap — for example BTC → XMR — and read crypto privacy mistakes. No account, no ID, no logs.