Electrum BAD signature: what it means

Good signature vs BAD signature is not a warning banner to click through. Hash the installer here, then treat BAD as a hard stop.

Security Guides · 6 min · Updated Jul 2026 · Expert

A GnuPG BAD signature on Electrum means gpg --verify already decided the installer and the .asc do not match under that key. Do not run electrum-4.5.5-setup.exe.

Hash the same .exe on this page. If SHA-256 also fails, you have a bad binary. If SHA-256 matches our catalog but GPG is BAD, you have a signature/key problem — still not an install.

Do this now

  1. Keep both files, run nothing. You need the installer and the .asc from download.electrum.org. Do not mix an .asc from a blog with an .exe from a mirror.
  2. SHA-256 the installer here. Preset electrum_windows. Record whether integrity passed. Then go back to GPG.
  3. Re-download the pair and verify ThomasV. Import 0x6694D8DE7BE8EE56 only after electrum.org’s fingerprint matches. If BAD persists, stop — see the table.

gpg output → cause → fix

OutputCauseFix
BAD signaturePayload or .asc changed, or wrong keyDelete; official pair; confirm fingerprint
Can't check signature: public key not foundKey not importedrecv-keys after fingerprint check
Good signature from unknown keyYou imported somethingCompare fingerprint to electrum.org
Hashes do NOT match (this page)Integrity already failedSkip GPG; mismatch page
gpg --verify electrum-4.5.5-setup.exe.asc electrum-4.5.5-setup.exe
Never “fix” BAD signature by deleting the .asc and installing anyway. The .asc is the point.

What BAD signature cannot mean

It cannot mean your clock is slightly wrong in a way you should ignore. It cannot mean GPG is “too strict for Windows.” It means verification failed.

WalletGuard cannot re-sign Electrum for you.

Happy path: GPG-verify Electrum.
Live artifact · preset electrum_windows

Catalog hash loads from WalletGuard’s wallet database. Confirm the same string on the developer’s signed release before you install.

Hash this file in the browser

Nothing is uploaded. Web Crypto SHA-256 stays on this device.

·
SHA-256

Compare to the catalog hash

This page pre-selects electrum_windows. Switch wallets if you grabbed a different build.

Preset hash: loads from catalog

No file selected yet.

Open the full verifier with this preset →

Frequently asked questions

What does Electrum BAD signature mean?

gpg --verify failed for that installer/.asc pair. Treat the files as untrusted. Re-download both from download.electrum.org and confirm ThomasV’s fingerprint on electrum.org.

SHA-256 matched but GPG is BAD. Install?

No. Integrity and authenticity are different. A matching hash against a wrong catalog row, or a swapped .asc, still fails GPG. Do not install.

Can I use MD5 instead of GPG?

No. MD5 is not a signature. Electrum’s authenticity control is GPG on the .asc.

Open verifier · electrum_windows