GitHub release vs Softonic-style wallet mirrors

Mirrors win search. Official Releases lose. The job: vendor org + Releases tag + hash. Electrum still prefers download.electrum.org over a random fork zip.

Security Guides · 7 min · Updated Jul 2026 · Expert

GitHub release vs a Softonic/FileHippo/“official mirror” page is not a taste choice: wallet installers from portals are how people get a helper exe bundled next to Sparrow or Electrum.

Sparrow’s real assets live on github.com/sparrowwallet/sparrow/releases and sparrowwallet.com. Electrum’s signed Windows build is on download.electrum.org, not a GitHub fork named ElectrumPlus.

Do this now

  1. Identify the vendor’s real org. Sparrow: sparrowwallet/sparrow. Electrum source: spesmilo/electrum. Ledger Live: Ledger’s own download host. If the org name is new, stop.
  2. Hash the asset you downloaded. This page presets sparrow_windows. If you grabbed Electrum instead, switch the dropdown. A mirror zip that “contains Sparrow” will not match.
  3. Prefer the vendor domain when they say so. Electrum tells you to use download.electrum.org. A GitHub zip of source is not the same as the signed setup.exe. Use the pair they document.

What you lose on a mirror

Channel → what drops out
ChannelYou still getYou lose
Vendor site + signed releaseIntended binary + digest/.ascConvenience of the first Google ad
Official GitHub Releases assetThe file the tag attachedNothing if the org is correct
Softonic / “CNET download”A renamed installerGPG, correct digest, often the real binary
Look-alike GitHub orgA repo that buildsThe vendor’s signing key
Search ads for wallet names are a separate scam class — malvertising.

What a green GitHub badge cannot do

Stars do not sign binaries. A README badge is not GPG. Forks inherit names. You need the org the vendor links from their HTTPS site, then the hash on this page.

WalletGuard does not host mirrors and does not wrap GitHub’s CDN.

Electrum’s real host: Electrum official download. Exodus portals: Exodus official download.
Live artifact · preset sparrow_windows

Catalog hash loads from WalletGuard’s wallet database. Confirm the same string on the developer’s signed release before you install.

Hash this file in the browser

Nothing is uploaded. Web Crypto SHA-256 stays on this device.

·
SHA-256

Compare to the catalog hash

This page pre-selects sparrow_windows. Switch wallets if you grabbed a different build.

Preset hash: loads from catalog

No file selected yet.

Open the full verifier with this preset →

Frequently asked questions

Is GitHub always the official wallet download?

Only if the vendor says so and the org matches their site. Electrum’s signed Windows installer is on download.electrum.org. Sparrow does use GitHub Releases. Softonic is never official.

How do I know a GitHub org is real?

Open the wallet’s official HTTPS site first and use the GitHub link they print. Do not search “Sparrow Wallet GitHub” and click the ad.

The mirror’s hash matches a screenshot — safe?

No. The screenshot and the malware can share an author. Compare to the vendor’s release page, then this verifier.

Open verifier · sparrow_windows