Software safety
Verify wallet downloads before opening them
Begin at a known official website, then follow its current verification procedure. A matching hash and a verified publisher signature answer different questions.
Contents & sources
Establish the source before the file
A search result, advertisement or reply in a community chat can lead to a convincing download page. Start with the official project address and follow its own download links. For an extension or mobile app, use the store link from that official path rather than choosing by icon alone.
Keep the source address in your records once verified. A bookmark reduces repeated searching, but check the address if something unexpected opens. A browser’s encrypted-connection indicator says nothing about whether the domain belongs to the project you intended.
Understand what a hash proves
A cryptographic hash is a fingerprint of a file. Comparing the downloaded file with a trusted published hash can detect a mismatch. If both the file and hash come from an attacker-controlled source, agreement between them does not establish authenticity.
Use the exact current procedure for your operating system and file type. Do not improvise a command from an old article when the publisher provides signed verification instructions. A missing or different hash is a reason to stop, not to keep trying random download mirrors.
Understand what a signature adds
A verified signature can connect a release to a particular signing key. You still need to establish that the key is the project’s intended key. Importing whichever key appears beside an unknown file can produce a technically valid but unhelpful result.
Read the project’s instructions for key identity, signature verification and release status. COLDCARD’s procedure, for example, distinguishes verifying a file hash from verifying the signed hash list. Sparrow’s quick start also directs users to verify the download before installation.
Check advisories before changing a device
An update may fix future behavior without correcting every consequence of past behavior. Read release notes and security status before setup, recovery or funding. The current COLDCARD advisory explicitly distinguishes updating firmware from migrating an affected existing seed.
Prepare the wallet’s documented recovery plan before an update, without entering secrets into a download page. Understand the rollback restrictions and device instructions that apply to your exact model. The safest next action can depend on how the existing wallet was created.
Use a stop rule
Stop if the domain, signature, release version or device behavior differs from the instructions. Reach support through the official site you established independently. Do not grant remote computer access or share a recovery phrase with someone offering to fix a verification error.
This guide intentionally avoids frozen commands and release numbers. The current publisher procedure is the right place for those details. Our wallet profiles link to official sources; the editorial process explains why those links take priority over a timeless-sounding verdict.
Sources & scope
Source-based desk research. Checked . Product specifications and documentation can change. No hands-on testing or independent security audit is claimed.