Verify your Monero download
Fake wallets are the most common Monero scam. Check the signed SHA256 hashes before you install anything.
4 min read
Why verify
Verifying is the only way to be sure you are running the official Monero software. If you received a fake binary through phishing or a tampered download, its hash will not match the signed list.
1. Import and check the signing key
Download binaryFate's key from the Monero repository and check its fingerprint. If it does not match exactly, stop and delete the file.
gpg --keyid-format long --with-fingerprint binaryfate.asc # must show: 81AC 591F E9C4 B65C 5806 AFC3 F0AF 4D46 2A0B DF92 gpg --import binaryfate.asc
2. Check the hash file
Download hashes.txt from getmonero.org/downloads/hashes.txt and verify its signature. Continue only if it says Good signature from binaryFate. The warning that the key is not certified is normal.
gpg --verify hashes.txt
3. Check your download
Compute the SHA256 of the file you downloaded and compare it with the line for that file in hashes.txt. If it does not match, delete the file and download it again from getmonero.org.
shasum -a 256 monero-gui-linux-x64-vX.Y.Z.tar.bz2 # Linux / macOS certUtil -hashfile monero-gui-win-x64-vX.Y.Z.zip SHA256 # Windows
Other wallets
Third-party wallets such as Feather or Cake Wallet are published by their own teams. Download them only from the sites listed on getmonero.org/downloads; RugWard's site checker tells you whether a link matches that list.
Sources
Next: Use a new subaddress for each payer
Educational content, not legal or financial advice. Users are responsible for complying with their local laws. Internally reviewed by RugWard.