Package is invalid: CRX_HEADER_INVALID

The error string is the H1. Hash the file to see what you actually downloaded, then abandon sideload for the official Chrome listing.

Security Guides · 5 min · Updated Jul 2026 · Expert

Chrome’s CRX_HEADER_INVALID means the bytes are not a valid CRX package — a zip renamed to .crx, a truncated download, or garbage. It is not a hint to run a “CRX repair” tool on a wallet.

Hash the file below (preset rabby_chrome if you thought it was Rabby). Then install from rabby.io / the official ID instead of fighting the packager.

Do this now

  1. Do not run CRX fixers. Third-party “repair crx” utilities are malware magnets. Delete the file.
  2. Hash it only to identify the download. If SHA-256 matches a catalog wallet, you still install from the store, not by forcing the broken package.
  3. Use the official listing. Rabby: acmacodkjbdgmoleebolmdjonilkdbch. Phantom and MetaMask IDs are on their download guides.

CRX_HEADER_INVALID → cause → fix

SituationCauseFix
Renamed .zip → .crxMissing CRX headerStop sideloading; store install
Download stopped at 20%Truncated fileRe-download from vendor store, not the zip
Unpacked folder zippedNot a CRXDo not Load unpacked for custody wallets
Hashes do NOT matchWrong or tainted filemismatch
Developer mode → Load unpacked on a folder from Telegram is the same class of mistake, even if Chrome never prints CRX_HEADER_INVALID.

What a “CRX repair” cannot do

It cannot turn a zip of a fake wallet into MetaMask. It cannot restore a store listing. Invalid header means stop.

This website will not generate a CRX for you.

How to hash a real .crx: hash a Chrome wallet .crx.
Live artifact · preset rabby_chrome

Catalog hash loads from WalletGuard’s wallet database. Confirm the same string on the developer’s signed release before you install.

Hash this file in the browser

Nothing is uploaded. Web Crypto SHA-256 stays on this device.

·
SHA-256

Compare to the catalog hash

This page pre-selects rabby_chrome. Switch wallets if you grabbed a different build.

Preset hash: loads from catalog

No file selected yet.

Open the full verifier with this preset →

Frequently asked questions

What does CRX_HEADER_INVALID mean?

Chrome rejected the package as not a valid CRX. Delete it. Install the wallet from the vendor’s Chrome Web Store listing and official ID.

Can I unzip the crx and load it unpacked?

Not as a user installing a custody wallet. That bypasses the store ID check that is the whole point.

Should I hash a file that already failed CRX_HEADER_INVALID?

Yes if you want to know whether it matches a known catalog digest. No if you intend to install that same file. Identification ≠ permission to sideload.

Open verifier · rabby_chrome