How to hash a Chrome wallet .crx file

Chrome Web Store installs do not give you a hash UI. This page is for people who actually have a .crx and need to hash it without treating sideload as normal.

Security Guides · 6 min · Updated Jul 2026 · Expert

To hash a Chrome wallet .crx, drop the packed extension into the verifier on this page and compare SHA-256 — then still confirm the extension ID in the store URL. A matching hash on a .crx from Discord is not an official install.

Normal users should install from the store listing the vendor linked. Hashing .crx is for incident response, mirrors you should not have used, and packed backups.

Do this now

  1. Prefer the official store listing. If you only meant to install Rabby or Phantom, go back to rabby.io / phantom.app and use Add to Chrome. You may not need a .crx at all.
  2. If you already have a .crx, hash it here. Preset defaults to rabby_chrome. Switch to phantom_chrome, keplr_chrome, or rainbow_chrome to match the file you actually saved.
  3. Install from the store, not from the .crx, after a match. A hash match against our catalog means the file matched that snapshot. Chrome’s supported path is still the Web Store listing with the official ID. Sideload only if you know why.

CRX hash vs extension ID

CheckWorks onFails open if
Extension ID in store URLAny Chrome listingYou never look at the URL
SHA-256 of a .crxA file on diskYou hashed a different wallet’s preset
chrome://extensions IDInstalled extensionYou packed an unpacked fake yourself

Optional: hash in PowerShell if you refuse the browser

Get-FileHash .\rabby.crx -Algorithm SHA256
CRX_HEADER_INVALID means the package is not a valid CRX — see Package is invalid: CRX_HEADER_INVALID. Do not “fix” it with a random repack.

What a .crx hash cannot do

It cannot show future Web Store updates. It cannot prove the unpacked folder you loaded in Developer mode matches the store. It hashes one file.

This site will not install a .crx into Chrome for you. Origin isolation and Chrome’s security model forbid that from a webpage.

ID-first workflow: confirm a browser extension ID. Store error: not listed in the Chrome Web Store.
Live artifact · preset rabby_chrome

Catalog hash loads from WalletGuard’s wallet database. Confirm the same string on the developer’s signed release before you install.

Hash this file in the browser

Nothing is uploaded. Web Crypto SHA-256 stays on this device.

·
SHA-256

Compare to the catalog hash

This page pre-selects rabby_chrome. Switch wallets if you grabbed a different build.

Preset hash: loads from catalog

No file selected yet.

Open the full verifier with this preset →

Frequently asked questions

How do I SHA-256 a wallet .crx?

Drop the .crx into the verifier on this page and select the matching catalog preset. Or run Get-FileHash / shasum on the file and paste the digest into the comparer.

Should I install wallets from .crx files?

No, not as the default. Use the vendor’s Chrome Web Store link and the official ID. Hash a .crx only when you already have that file and need to know what it is.

Why did Chrome reject my .crx?

Invalid headers, wrong CRX version, or a renamed zip. That is the CRX_HEADER_INVALID class of failure — stop sideloading and use the store listing.

Open verifier · rabby_chrome