Verify a wallet download with certutil on Windows

PowerShell Get-FileHash is in the general guide. This page is the certutil -hashfile path for locked-down Windows images that still ship certutil.

Security Guides · 6 min · Updated Jul 2026 · Expert

Use certutil -hashfile when you need a SHA-256 of a wallet installer on Windows without PowerShell execution policy fights: certutil -hashfile electrum-4.5.5-setup.exe SHA256.

The general verify guide already shows Get-FileHash. This page exists because certutil is what many corporate images still allow. Then paste the digest into the comparer below — or skip the terminal and drop the file on this page.

Do this now

  1. Keep the official installer. Example job: Electrum from download.electrum.org, sitting as electrum-4.5.5-setup.exe in your Downloads folder.
  2. Hash in cmd or drop the file here. Run certutil as below, or drop the same file into the verifier (preset electrum_windows). Both must agree with each other and with the official digest.
  3. Install only on a match. If certutil, this page, and Electrum’s published digest disagree, delete the file. Do not run it “to see.”

certutil syntax for wallet files

FlagUse for walletsDo not
SHA256Default integrity check on this siteDo not compare SHA256 output to an MD5
SHA1Only if a vendor still publishes SHA-1Do not treat SHA-1 as modern integrity
MD5Legacy vendor tablesDo not use MD5 as the only check
certutil -hashfile %USERPROFILE%\Downloads\electrum-4.5.5-setup.exe SHA256
certutil -hashfile .\Ledger-Live-windows.exe SHA256
certutil prints extra banner lines. Compare only the 64-character hex, case-insensitive, no spaces.

What certutil cannot do

It cannot prove who published the digest. That is GPG. It cannot prove a Chrome extension ID. It hashes a file you already have.

Authenticode signtool verify is a different check (publisher Authenticode). Electrum’s real authenticity story is GPG, not Microsoft SmartScreen.

PowerShell twin: verify a wallet download. Hash mismatch: hashes do not match.
Live artifact · preset electrum_windows

Catalog hash loads from WalletGuard’s wallet database. Confirm the same string on the developer’s signed release before you install.

Hash this file in the browser

Nothing is uploaded. Web Crypto SHA-256 stays on this device.

·
SHA-256

Compare to the catalog hash

This page pre-selects electrum_windows. Switch wallets if you grabbed a different build.

Preset hash: loads from catalog

No file selected yet.

Open the full verifier with this preset →

Frequently asked questions

What is the certutil command to SHA-256 a wallet installer?

certutil -hashfile path\to\installer.exe SHA256. Compare the hex to the official digest and to this page’s comparer.

Why not only Get-FileHash?

Get-FileHash is fine when PowerShell is allowed. certutil is the fallback on restricted Windows images. The digest math is the same SHA-256.

Can I skip certutil and use WalletGuard?

Yes. Drop the same file into the verifier on this page. Use certutil when you want a second local tool that is not the browser.

Open verifier · electrum_windows