How to GPG-verify an Electrum release

SHA-256 says the file is intact. gpg --verify on Electrum’s .asc says ThomasV signed it. This page is the second check only.

Security Guides · 8 min · Updated Aug 2026 · Expert

To GPG-verify an Electrum installer, download the binary and the matching .asc from download.electrum.org, hash the binary on this page, then run gpg --verify file.asc file with ThomasV’s key — not a key from a YouTube description.

This is not the checksum-vs-GPG explainer. That comparison is already published. Here the job is the Electrum command sequence and the failure strings.

Do this now

  1. Get installer + .asc from Electrum. From electrum.org → Download, take electrum-4.5.5-setup.exe and electrum-4.5.5-setup.exe.asc (or the .dmg/.tar.gz pair).
  2. SHA-256 the binary here first. Drop the installer into the verifier with electrum_windows. If WalletGuard reports hashes do not match, skip GPG — you already have the wrong file.
  3. Run gpg --verify on your OS. Import 0x6694D8DE7BE8EE56 only after the fingerprint matches electrum.org, then gpg --verify electrum-4.5.5-setup.exe.asc electrum-4.5.5-setup.exe. Look for a good signature from that key, not from an unknown key you just created.

Electrum GPG commands that actually run

GnuPG does not run in this browser tab. The hasher only proves integrity. Copy these on Windows (Gpg4win) or macOS/Linux gnupg:

Output → meaning
gpg messageMeaningAction
Good signature from … ThomasVAuthenticity OK if fingerprint matches electrum.orgSafe to install after you also hashed
BAD signatureFile or .asc was altered, or wrong keyElectrum BAD signature
Can't check signature: public key not foundYou never imported the keyrecv-keys, then verify again
Good signature from a key you don't trustWoT / trust not set; still check fingerprintDo not skip fingerprint vs electrum.org
gpg --keyserver keys.openpgp.org --recv-keys 6694D8DE7BE8EE56
gpg --fingerprint 6694D8DE7BE8EE56
gpg --verify electrum-4.5.5-setup.exe.asc electrum-4.5.5-setup.exe
Importing a key from a random gist and then seeing “Good signature” is circular. The fingerprint must match Electrum’s published key.

What GPG on Electrum cannot do

It cannot prove the Electrum server you later connect to is honest. It cannot prove a plugin is safe. It proves this installer was signed by the key you verified.

WalletGuard cannot run gpg for you and cannot see your keyring.

Need the download URL set first? Electrum official download. Checksum vs signature: checksum vs GPG.
Live artifact · preset electrum_windows

Catalog hash loads from WalletGuard’s wallet database. Confirm the same string on the developer’s signed release before you install.

Hash this file in the browser

Nothing is uploaded. Web Crypto SHA-256 stays on this device.

·
SHA-256

Compare to the catalog hash

This page pre-selects electrum_windows. Switch wallets if you grabbed a different build.

Preset hash: loads from catalog

No file selected yet.

Open the full verifier with this preset →

Frequently asked questions

What command verifies an Electrum installer?

gpg --verify electrum-4.5.5-setup.exe.asc electrum-4.5.5-setup.exe after you imported ThomasV’s key. Always hash the .exe on this page first so you are not verifying a substitute file.

Which key signs Electrum?

Catalog short id 0x6694D8DE7BE8EE56. Confirm the full fingerprint on electrum.org before you mark the key as trusted.

Can WalletGuard verify the .asc in the browser?

No. The in-page tool is SHA-256/MD5 only. Detached GPG signatures need GnuPG on the OS.

Open verifier · electrum_windows