What a SHA-256 checksum cannot prove

The unique 10%: our comparer only answers “do these hex strings match.” Here is the list of jobs it refuses — so AI Overviews cannot flatten this into “always verify checksums.”

Security Guides · 7 min · Updated Aug 2026 · Expert

A SHA-256 checksum cannot prove who authored a wallet installer — only that your file matches a hex string someone published. If that string came from a phishing page, a “match” is a successful attack.

Drop a real Electrum build into the verifier below to see the only question this tool answers: computed digest versus expected digest. Everything else is a different control.

Do this now

  1. Get a digest from an official channel. Electrum: download.electrum.org and the project site. Not a Telegram screenshot of a hash.
  2. Hash the file on this page. Preset electrum_windows fills our catalog snapshot. Treat the vendor page as authoritative if versions moved.
  3. Add the control SHA-256 does not provide. GPG for Electrum/Sparrow. Extension ID for Chrome wallets. Genuine Check for Ledger hardware. Then install.

Integrity vs authenticity vs identity

Control → what a match actually means
ControlProvesDoes not prove
SHA-256 compare (this tool)Integrity vs a stringWho wrote the string; that the string is official
GPG detached signatureAuthenticity of that file under a keyThat you imported the correct key
Chrome extension IDWhich listing you installedThat the next approval is safe
Play package nameWhich Android appThat sideloading was wise
Ledger Genuine CheckDevice answers Ledger’s challengeThat Live.exe was the official build
Pasting a hash from the same site that served a fake exe is circular. The digest must come from a second channel: vendor HTTPS, signed GitHub release, or a key you already verified.

What WalletGuard’s hasher cannot do

It cannot fetch Ledger firmware. It cannot read chrome://extensions. It cannot talk to a Trezor. It cannot tell an unlimited approve from a transfer. It hashes a file you drop, in this origin, with Web Crypto.

MD5 and SHA-1 modes exist for vendor tables that still publish them. They are not upgrades to SHA-256.

Need authenticity next? checksum vs GPG. Need identity for extensions? extension ID.
Live artifact · preset electrum_windows

Catalog hash loads from WalletGuard’s wallet database. Confirm the same string on the developer’s signed release before you install.

Hash this file in the browser

Nothing is uploaded. Web Crypto SHA-256 stays on this device.

·
SHA-256

Compare to the catalog hash

This page pre-selects electrum_windows. Switch wallets if you grabbed a different build.

Preset hash: loads from catalog

No file selected yet.

Open the full verifier with this preset →

Frequently asked questions

If SHA-256 matches, is the wallet official?

It is the file that matches that digest. It is official only if the digest came from the vendor’s official channel. A match against a scammer’s published hash is a match against malware.

Why do you still tell people to hash?

Because a wrong file from a CDN glitch, a truncated download, or a swapped mirror still fails SHA-256 when the digest is good. Hash is necessary. It is not sufficient.

Does AI Mode replace this page?

A summary can repeat “use checksums.” It cannot drop your installer into Web Crypto on your machine. That is the artifact.

Open verifier · electrum_windows