Electrum official download: site, hash, then GPG

Electrum has been cloned for a decade. The real job is electrum.org → download.electrum.org → hash → gpg --verify on the .asc.

Security Guides · 7 min · Updated Aug 2026 · Expert

An Electrum official download comes from electrum.org (which points at download.electrum.org), never from SourceForge, Softonic, or electrum-wallet.com.

Electrum publishes a Windows .exe, macOS .dmg, Linux tarball, and a matching .asc for GPG. Hash first on this page, then prove ThomasV signed those bytes.

Do this now

  1. Take the files from download.electrum.org. Open electrum.org, follow Download, and grab both electrum-4.5.5-setup.exe and electrum-4.5.5-setup.exe.asc (version as listed). Same pair exists for .dmg and .tar.gz.
  2. SHA-256 the installer here. Drop the .exe into the verifier with preset electrum_windows. A mismatch means you do not even start GPG — the file is already wrong.
  3. Verify the .asc on your machine. Import ThomasV’s key 0x6694D8DE7BE8EE56 and run gpg --verify electrum-4.5.5-setup.exe.asc electrum-4.5.5-setup.exe. You want a good signature from the expected fingerprint, not “good signature” from a key you just imported off a random blog.

Official Electrum hosts

The project site is electrum.org. Binaries are served from download.electrum.org. GitHub spesmilo/electrum is source, not a substitute for the signed Windows installer if you are not building it yourself.

Electrum 4.5.5 artifacts
ArtifactHostNext check
electrum-4.5.5-setup.exedownload.electrum.orgSHA-256 + .asc
electrum-4.5.5.dmgdownload.electrum.orgSHA-256 + .asc
electrum-4.5.5.tar.gzdownload.electrum.orgSHA-256 + .asc
“ElectrumPro.exe” from a mirrorAnywhere elseDelete

GPG after a hash match

gpg --keyserver keys.openpgp.org --recv-keys 6694D8DE7BE8EE56
gpg --verify electrum-4.5.5-setup.exe.asc electrum-4.5.5-setup.exe
A BAD signature is a different job — see Electrum BAD signature. Do not “install anyway.”

What this page cannot do for Electrum

The browser hasher cannot import GPG keys or validate a detached .asc. We compute SHA-256 only. Authenticity is gpg --verify on your OS.

We are not Electrum developers and we do not run Electrum servers.

Full GPG walkthrough: GPG-verify an Electrum release. Checksum vs signature: checksum vs GPG.
Live artifact · preset electrum_windows

Catalog hash loads from WalletGuard’s wallet database. Confirm the same string on the developer’s signed release before you install.

Hash this file in the browser

Nothing is uploaded. Web Crypto SHA-256 stays on this device.

·
SHA-256

Compare to the catalog hash

This page pre-selects electrum_windows. Switch wallets if you grabbed a different build.

Preset hash: loads from catalog

No file selected yet.

Open the full verifier with this preset →

Frequently asked questions

What is the official Electrum download URL?

Start at electrum.org and use the Download links to download.electrum.org. That host is where the signed 4.5.5 installers and .asc files live.

What GPG key signs Electrum?

ThomasV’s key id in our catalog is 0x6694D8DE7BE8EE56. Confirm the full fingerprint on electrum.org before you treat a newly imported key as trusted.

Is a SHA-256 match enough for Electrum?

It proves integrity against a published digest. Electrum also ships GPG signatures so you can prove who signed that digest. Do both for a first install on a new PC.

Open verifier · electrum_windows