How to GPG-verify a Sparrow Wallet build

Sparrow ships signed release assets. Hash first with the sparrow_windows preset, then gpg --verify using the key Sparrow publishes — not a Discord key.

Security Guides · 7 min · Updated Aug 2026 · Expert

To GPG-verify a Sparrow build, take Sparrow-2.1.3.exe (or .dmg/.tar.gz) plus the signature files from sparrowwallet.com or the official GitHub release, SHA-256 the binary here, then gpg --verify with the fingerprint Sparrow prints on that download page.

Our catalog lists 0xCEF5A1E4A7BF0F52. That is a convenience snapshot — Sparrow’s site is the authority if the two ever disagree.

Do this now

  1. Download asset + signature from Sparrow. Use sparrowwallet.com/download or github.com/sparrowwallet/sparrow/releases/tag/2.1.3. Get the installer and the .asc/.sig Sparrow placed beside it.
  2. Hash the installer on this page. Preset sparrow_windows (or mac/linux). A failed compare means you do not run GPG on a bad file.
  3. gpg --verify on the host. Import the key only after the fingerprint matches sparrowwallet.com. Then verify the detached signature against the installer you just hashed.

Sparrow GPG sequence

FileRoleIf missing
Sparrow-2.1.3.exePayloadYou cannot verify air
.asc / .sigDetached signatureDo not invent one; re-download from Sparrow
Catalog SHA-256Integrity shortcutPaste Sparrow’s published digest if versions moved
gpg --fingerprint CEF5A1E4A7BF0F52
# confirm this matches sparrowwallet.com/download
gpg --verify Sparrow-2.1.3.exe.asc Sparrow-2.1.3.exe
A “Sparrow signed by GitHub” comment is not a substitute for Sparrow’s own key. GitHub’s UI can still serve a file you mis-clicked in the wrong repo.

What Sparrow GPG cannot do

It cannot prove your Bitcoin node is yours. It cannot prove a PSBT you later load is the transaction you think. It proves this Sparrow binary was signed by the key you checked.

This website does not import keys into your keyring.

Download path: download Sparrow Wallet. Why Sparrow: Sparrow review.
Live artifact · preset sparrow_windows

Catalog hash loads from WalletGuard’s wallet database. Confirm the same string on the developer’s signed release before you install.

Hash this file in the browser

Nothing is uploaded. Web Crypto SHA-256 stays on this device.

·
SHA-256

Compare to the catalog hash

This page pre-selects sparrow_windows. Switch wallets if you grabbed a different build.

Preset hash: loads from catalog

No file selected yet.

Open the full verifier with this preset →

Frequently asked questions

How do I GPG-verify Sparrow Wallet?

Hash Sparrow-2.1.3.exe on this page, import the key whose fingerprint matches sparrowwallet.com, then gpg --verify on the detached signature Sparrow published next to the installer.

Where is Sparrow’s official signing key documented?

On sparrowwallet.com/download. Use that fingerprint even if a catalog or a tweet shows a short id.

Does WalletGuard run GPG?

No. We SHA-256 in the browser. GPG stays on your OS.

Open verifier · sparrow_windows