How to download Phantom safely and verify it's real

Editor's Pick GaurdWallet — our #1 recommended non-custodial wallet 20 networks from one seed phrase. Keys never leave your device. Open the web wallet →

Official Phantom path, the real ghost-icon extension ID, and a local hash check so a cloned listing cannot pass.

Security Guides · 7 min · Updated Aug 2026 · Expert

To download Phantom safely, type phantom.app/download yourself and refuse any listing whose Chrome ID is not bfnaelmomeimhlpmgjnjophhpkkoljpa.

WalletGuard is not Phantom. We only keep the official store URL and a catalog SHA-256 so you can prove the bytes on disk before the extension ever sees a seed.

Do this now

  1. Get the official listing. Open phantom.app from a bookmark or by typing it. Do not use a search ad. Follow Download to the Chrome Web Store, App Store, or Play listing that Phantom itself linked.
  2. Confirm the ID, then hash on this page. Read the 32-character ID after /detail/. It must be bfnaelmomeimhlpmgjnjophhpkkoljpa. If you sideloaded a .crx or unpacked zip, drop that file into the verifier below with the phantom_chrome preset.
  3. Install only after the listing and hash agree. Add the extension from the store page Phantom opened. Never restore a Secret Recovery Phrase into a brand-new clone to “test” it.

Official Phantom sources

Phantom’s website is phantom.app. The Chrome listing URL must end with /bfnaelmomeimhlpmgjnjophhpkkoljpa. iOS is App Store id 1598432977. Android package is app.phantom.

A page named “Phantom Wallet Official” on a different domain is not Phantom. Neither is a Telegram APK.

Phantom identity checks
CheckMust matchIf it differs
Chrome extension IDbfnaelmomeimhlpmgjnjophhpkkoljpaDo not Add to Chrome
Sitephantom.appLeave. Typosquats reuse the ghost icon
Android packageapp.phantomUninstall the APK; see Play Protect guide
Catalog presetphantom_chromeWrong preset compares the wrong hash
Seed warning: Phantom never DMs you a “sync” page. Anyone who asks for 12/24 words is stealing the wallet, not installing it.

What a Phantom store listing cannot prove

A high user count does not prove the next approval you sign is safe. The ID only proves you installed that listing — not that a mint site is honest.

SHA-256 on a .crx you saved yourself is useful. Chrome Web Store updates after install are a different file; re-check the ID in chrome://extensions if the icon ever looks off.

  • The listing cannot prove a dApp is safe.
  • The hash cannot prove who published a string you pasted from a random tweet.
  • This page cannot read your Phantom vault — origin isolation forbids it.
Need the ID workflow for any wallet? Use confirm a browser extension ID. MetaMask has its own safe download guide.
Live artifact · preset phantom_chrome

Catalog hash loads from WalletGuard’s wallet database. Confirm the same string on the developer’s signed release before you install.

Hash this file in the browser

Nothing is uploaded. Web Crypto SHA-256 stays on this device.

·
SHA-256

Compare to the catalog hash

This page pre-selects phantom_chrome. Switch wallets if you grabbed a different build.

Preset hash: loads from catalog

No file selected yet.

Open the full verifier with this preset →

Frequently asked questions

What is the official Phantom download site?

phantom.app, then the Download button. Type it. Do not click “Phantom download” ads. WalletGuard’s hub at wallet-phantom.html only mirrors that official path.

What is the official Phantom Chrome extension ID?

bfnaelmomeimhlpmgjnjophhpkkoljpa. It sits in the Chrome Web Store URL after /detail/. Any other 32-character ID is a different extension, even if the name is Phantom.

Can I verify a Phantom file with SHA-256?

Yes, if you have a file (exported .crx or an APK). Drop it into the verifier on this page with the phantom_chrome or phantom_android preset. Store-only installs still need the ID check; Chrome does not hand you a hash in the UI.

Is WalletGuard the Phantom team?

No. We are an independent directory and in-browser hasher. We do not ship Phantom builds and we do not provide Phantom support.

Open verifier · phantom_chrome