<p>As of Bitcoin Core v22.0, the signing and signature verification procedure has changed. See &quot;Verify your download&quot; on <a href="https://bitcoincore.org/en/download" rel="noreferrer">bitcoincore.org/en/download</a> for the official documentation.</p>
<p>Basically, the difference is that instead of a single signer there are now multiple signers that you can choose from. SHA256SUMS has the checksum hashes of the binaries, and then several key signers signed SHA256SUMS and stored their signatures in SHA256SUMS.asc. So to verify, you'll need to verify any signatures that you trust and then verify the checksum.</p>
<h2>To verify v22.0+:</h2>
<ol>
<li>Download a GPG key of at least one of the Bitcoin Core devs you trust (multiple is better). A list of keys is listed at the bottom:</li>
</ol>
<p>Find a GPG fingerprint</p>
<pre><code>gpg --keyserver keys.openpgp.org --search-keys &lt;email address or GPG key fingerprint&gt;
</code></pre>
<p>At the prompt, enter the number of the key you want to import.</p>
<blockquote>
<p>Note: <code>keys.opengpg.org</code> is a good keyserver but you can also try <code>pgp.mit.edu</code> or <code>keyserver.ubuntu.com</code>. You can also manually download the key file by going directly to the keyserver in your browser and import the key by using <code>gpg --import &lt;file&gt;</code>.</p>
</blockquote>
<ol start="2">
<li><p>Download the <code>SHA256SUMS.asc</code>, <code>SHA256SUMS</code>, and <code>bitcoin-&lt;version&gt;-&lt;architecture&gt;.&lt;tar.gz|zip|exe&gt;</code> from the official source (<a href="https://bitcoincore.org/bin/bitcoin-core-22.0/" rel="noreferrer">link to v22.0</a>)</p>
</li>
<li><p>Verify the signing signatures</p>
</li>
</ol>
<pre><code>gpg --verify SHA256SUMS.asc SHA256SUMS
</code></pre>
<p>You might see some &quot;Can't check signature: No public key&quot; if you're missing keys, but <strong>look for &quot;Good signature from ...&quot; for the keys you have imported</strong>. On linux you can also append <code> 2&gt;&amp;1 | grep &quot;Good signature&quot;</code> to the end of the above command to filter out the noise.</p>
<ol start="4">
<li>Verify the checksum hash in SHA256SUM that corresponds to your binary.</li>
</ol>
<p><em>On Windows</em>, you can right click on the binary &gt; CRC-SHA &gt; SHA-256 to view the hash and compare to what you see in SHA256SUM.</p>
<p><em>On linux</em>, you can use the following command:</p>
<pre><code>grep &quot; bitcoin-22.0-x86_64-linux-gnu.tar.gz&quot; SHA256SUMS | sha256sum -c
</code></pre>
<p>That's it!</p>
<p>List of signers' keys: <br />
<code>0xb10c@gmail.com</code>: 0CCBAAFD76A2ECE2CCD3141DE2FFD5B1D88CA97D <br />
<code>Andrew Chow achow101@gmail.com</code>: 152812300785C96444D3334D17565732E08E5E41 <br />
<code>Ben Carman benthecarman@live.com</code>: 0AD83877C1F0CD1EE9BD660AD7CC770B81FD22A8 <br />
<code>Antoine Poinsot darosior@protonmail.com</code>: 590B7292695AFFA5B672CBB2E13FC145CD3F4304 <br />
<code>Duncan Dean duncangleeddean@gmail.com</code>: 28F5900B1BB5D1A4B6B6D1A9ED357015286A333D <br />
<code>Stephan Oeste stephan@oeste.de</code>: 637DB1E23370F84AFF88CCE03152347D07DA627C <br />
<code>Michael Ford fanquake@gmail.com</code>: CFB16E21C950F67FA95E558F2EEB9F5CC09526C1 <br />
<code>Oliver Gugger gugger@gmail.com</code>: 6E01EEC9656903B0542B8F1003DB6322267C373B <br />
<code>Hennadii Stepanov hebasto@gmail.com</code>: D1DBF2C4B96F2DEBF4C16654410108112E7EA81F <br />
<code>Jon Atack jon@atack.com</code>: 82921A4B88FD454B7EB8CE3C796C4109063D4EAF <br />
<code>Wladimir J. van der Laan laanwj@gmail.com</code>: 9DEAE0DC7063249FB05474681E4AED62986CD25D <br />
<code>unknown</code>: 9D3CC86A72F8494342EA5FD10A41BDC3F4FAFF1C <br />
<code>Will Clark will8clark@gmail.com</code>: 74E2DEF5D77260B98BC19438099BAD163C70FBFA</p>

CC BY-SA 4.0
2021-11-02T17:31:52.753Z
It is documented on the website. See "Verify your download" on https://bitcoincore.org/en/download/
Pieter Wuille
CC BY-SA 4.0
2021-11-03T20:07:21.307Z
Ah yes, indeed it is! I incorrectly looked at the community website bitcoin.org. Thanks for the correction
kajoseph
CC BY-SA 4.0
2021-11-03T21:13:29.020Z
bitcoin org hasn't even updated to list 22.0...
Pieter Wuille
CC BY-SA 4.0
2022-02-24T07:30:05.010Z
Signers keys can be verified here: https://github.com/bitcoin/bitcoin/blob/master/contrib/builder-keys/keys.txt
Matt Popovich
CC BY-SA 4.0
2021-11-02T17:21:51.133Z
2021-11-03T20:10:51.943Z
2021-11-03T20:10:51.943Z
kajoseph
<p>To verify the build/downloaded file see the bitcoin core website: <a href="https://bitcoincore.org/en/download/" rel="nofollow noreferrer">https://bitcoincore.org/en/download/</a>.</p>
<p>They have a step by step for each platform under &quot;<strong>Verify your download</strong>&quot;</p>

CC BY-SA 4.0
2019-06-09T10:27:30.583Z
2022-02-27T10:45:31.457Z
2022-02-27T10:45:31.457Z
droid192
<p>This answer depends on that you are using <code>Bitcoin Core 0.13.1</code> and you have downloaded <code>bitcoin-0.13.1-win64.zip</code>, this answer will also work with any other bitcoin version or download with only change signer public key, checksum file and bitcoin download name.</p>

<p>First you need to import public key of the signer, in this case the key with id: <code>0x90C8019E36C2E964</code>, you do that by <code>--recv-keys</code> command line argument.</p>

<pre><code>gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964
</code></pre>

<p>Or you can manually download it from: <a href="http://pgp.mit.edu/pks/lookup?op=get&amp;search=0x90C8019E36C2E964" rel="noreferrer">http://pgp.mit.edu/pks/lookup?op=get&amp;search=0x90C8019E36C2E964</a></p>

<p>Next you need to download the signature file from her: <a href="https://bitcoin.org/bin/bitcoin-core-0.13.1/SHA256SUMS.asc" rel="noreferrer">https://bitcoin.org/bin/bitcoin-core-0.13.1/SHA256SUMS.asc</a>, and store it in same folder where bitcoin core download is stored. Then you need to check that the SHA256 checksum is valid.</p>

<pre><code>sha256sum --check SHA256SUMS.asc
</code></pre>

<p>Don't care about <code>FAILED open or read</code> or <code>No such file or directory</code> messages, you are looking for something like this: </p>

<pre><code>bitcoin-0.13.1-win64.zip: OK
</code></pre>

<p>If the checksum is valid, then you validate that the signature is good (checking that the checksums file is not tampered with). This is done by:</p>

<pre><code>gpg2 --verify SHA256SUMS.asc
</code></pre>

<p>This should output something like this:</p>

<pre><code>gpg: Signature made Thu 27 Oct 2016 08:21:11 PM CEST
gpg:                using RSA key 0x90C8019E36C2E964
gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) &lt;laanwj@gmail.com&gt;"
</code></pre>

<p><strong>EDIT:</strong>
If you get following message:</p>

<pre><code>gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner. 
Primary key fingerprint: 01EA 5486 DE18 A882 D4C2 6845 90C8 019E 36C2 E964
</code></pre>

<p>You have problems with trust, in other words, the public key for Wladimir J. van der Laan is not marked as a trusted key in gpg. You can mark it with some easy steps.</p>

<pre><code>gpg2 --edit-key 0x90C8019E36C2E964 ↵
trust ↵
5 ↵
quit ↵
</code></pre>

<p>You don't need to use <code>5</code> as trust, you can choose 1-5:</p>

<pre><code>1 = I don't know or won't say
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately
</code></pre>

CC BY-SA 4.0
2022-02-24T08:08:16.817Z
The key for Wladimir J. van der Laan has since expired? Their new one is 71A3B16735405025D447E8F274810B012346C9A6 which can be found at https://github.com/bitcoin/bitcoin/blob/master/contrib/builder-keys/keys.txt
Matt Popovich
CC BY-SA 4.0
2022-10-28T10:42:58.530Z
This answer is valid for old versions of Bitcoin Core. See @kajoseph's answer below for instructions for verifying Bitcoin Core download starting from 22.0: https://bitcoin.stackexchange.com/a/110517/101498.
Antoine Poinsot
CC BY-SA 3.0
2016-12-14T15:01:11.340Z
2017-12-22T21:52:55.297Z
2017-12-22T21:52:55.297Z
BufferOverflow
<p>I use Gpg4win but I don't know the step to verify the Bitcoin Core Release. can you give me the instruction how to verify released?</p>
<p>I got this result</p>
<pre><code>C:\WINDOWS\system32&gt;gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964
gpg: conversion from `utf-8' to `CP720' not available
gpg: requesting key 36C2E964 from hkp server pgp.mit.edu
gpg: key 36C2E964: &quot;Wladimir J. van der Laan (Bitcoin Core binary release signing key) &lt;laanwj@gmail.com&gt;&quot; not changed
gpg: Total number processed: 1
gpg:              unchanged: 1
</code></pre>

<bitcoin-core><signature><pgp>
How to verify Bitcoin Core Release Signing Keys
Hamad Aziz
# How to verify Bitcoin Core Release Signing Keys

(Asked by: username_0 on 2016-12-14)

I use Gpg4win but I don't know the step to verify the Bitcoin Core Release. can you give me the instruction how to verify released?

I got this result

```
C:\WINDOWS\system32>gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964
gpg: conversion from `utf-8' to `CP720' not available
gpg: requesting key 36C2E964 from hkp server pgp.mit.edu
gpg: key 36C2E964: "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>" not changed
gpg: Total number processed: 1
gpg:              unchanged: 1

```

**Tags:** bitcoin-core, signature, pgp


---

## 3 answers

### Answer by username_5 on 2016-12-14. Score: 9 | Accepted answer

This answer depends on that you are using `Bitcoin Core 0.13.1` and you have downloaded `bitcoin-0.13.1-win64.zip`, this answer will also work with any other bitcoin version or download with only change signer public key, checksum file and bitcoin download name.

First you need to import public key of the signer, in this case the key with id: `0x90C8019E36C2E964`, you do that by `--recv-keys` command line argument.

```
gpg2 --keyserver pgp.mit.edu --recv-keys 0x90C8019E36C2E964

```

Or you can manually download it from: <http://pgp.mit.edu/pks/lookup?op=get&search=0x90C8019E36C2E964>

Next you need to download the signature file from her: <https://bitcoin.org/bin/bitcoin-core-0.13.1/SHA256SUMS.asc>, and store it in same folder where bitcoin core download is stored. Then you need to check that the SHA256 checksum is valid.

```
sha256sum --check SHA256SUMS.asc

```

Don't care about `FAILED open or read` or `No such file or directory` messages, you are looking for something like this:

```
bitcoin-0.13.1-win64.zip: OK

```

If the checksum is valid, then you validate that the signature is good (checking that the checksums file is not tampered with). This is done by:

```
gpg2 --verify SHA256SUMS.asc

```

This should output something like this:

```
gpg: Signature made Thu 27 Oct 2016 08:21:11 PM CEST
gpg:                using RSA key 0x90C8019E36C2E964
gpg: Good signature from "Wladimir J. van der Laan (Bitcoin Core binary release signing key) <laanwj@gmail.com>"

```

**EDIT:**
If you get following message:

```
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner. 
Primary key fingerprint: 01EA 5486 DE18 A882 D4C2 6845 90C8 019E 36C2 E964

```

You have problems with trust, in other words, the public key for Wladimir J. van der Laan is not marked as a trusted key in gpg. You can mark it with some easy steps.

```
gpg2 --edit-key 0x90C8019E36C2E964 ↵
trust ↵
5 ↵
quit ↵

```

You don't need to use `5` as trust, you can choose 1-5:

```
1 = I don't know or won't say
2 = I do NOT trust
3 = I trust marginally
4 = I trust fully
5 = I trust ultimately

```

> **Comments:**
> **username_3**: The key for Wladimir J. van der Laan has since expired? Their new one is 71A3B16735405025D447E8F274810B012346C9A6 which can be found at https://github.com/bitcoin/bitcoin/blob/master/contrib/builder-keys/keys.txt  
> **username_6**: This answer is valid for old versions of Bitcoin Core. See @username_1's answer below for instructions for verifying Bitcoin Core download starting from 22.0: https://bitcoin.stackexchange.com/a/110517/101498.  

---

### Answer by username_1 on 2021-11-02. Score: 7

As of Bitcoin Core v22.0, the signing and signature verification procedure has changed. See "Verify your download" on [bitcoincore.org/en/download](https://bitcoincore.org/en/download) for the official documentation.

Basically, the difference is that instead of a single signer there are now multiple signers that you can choose from. SHA256SUMS has the checksum hashes of the binaries, and then several key signers signed SHA256SUMS and stored their signatures in SHA256SUMS.asc. So to verify, you'll need to verify any signatures that you trust and then verify the checksum.

## To verify v22.0+:

1. Download a GPG key of at least one of the Bitcoin Core devs you trust (multiple is better). A list of keys is listed at the bottom:

Find a GPG fingerprint

```
gpg --keyserver keys.openpgp.org --search-keys <email address or GPG key fingerprint>

```

At the prompt, enter the number of the key you want to import.

> Note: `keys.opengpg.org` is a good keyserver but you can also try `pgp.mit.edu` or `keyserver.ubuntu.com`. You can also manually download the key file by going directly to the keyserver in your browser and import the key by using `gpg --import <file>`.

2. Download the `SHA256SUMS.asc`, `SHA256SUMS`, and `bitcoin-<version>-<architecture>.<tar.gz|zip|exe>` from the official source ([link to v22.0](https://bitcoincore.org/bin/bitcoin-core-22.0/))
3. Verify the signing signatures

```
gpg --verify SHA256SUMS.asc SHA256SUMS

```

You might see some "Can't check signature: No public key" if you're missing keys, but **look for "Good signature from ..." for the keys you have imported**. On linux you can also append  `2>&1 | grep "Good signature"` to the end of the above command to filter out the noise.

4. Verify the checksum hash in SHA256SUM that corresponds to your binary.

*On Windows*, you can right click on the binary > CRC-SHA > SHA-256 to view the hash and compare to what you see in SHA256SUM.

*On linux*, you can use the following command:

```
grep " bitcoin-22.0-x86_64-linux-gnu.tar.gz" SHA256SUMS | sha256sum -c

```

That's it!

List of signers' keys:   
`0xb10c@gmail.com`: 0CCBAAFD76A2ECE2CCD3141DE2FFD5B1D88CA97D   
`Andrew Chow achow101@gmail.com`: 152812300785C96444D3334D17565732E08E5E41   
`Ben Carman benthecarman@live.com`: 0AD83877C1F0CD1EE9BD660AD7CC770B81FD22A8   
`username_6 username_6 darosior@protonmail.com`: 590B7292695AFFA5B672CBB2E13FC145CD3F4304   
`Duncan Dean duncangleeddean@gmail.com`: 28F5900B1BB5D1A4B6B6D1A9ED357015286A333D   
`Stephan Oeste stephan@oeste.de`: 637DB1E23370F84AFF88CCE03152347D07DA627C   
`Michael Ford fanquake@gmail.com`: CFB16E21C950F67FA95E558F2EEB9F5CC09526C1   
`Oliver Gugger gugger@gmail.com`: 6E01EEC9656903B0542B8F1003DB6322267C373B   
`Hennadii Stepanov hebasto@gmail.com`: D1DBF2C4B96F2DEBF4C16654410108112E7EA81F   
`Jon Atack jon@atack.com`: 82921A4B88FD454B7EB8CE3C796C4109063D4EAF   
`Wladimir J. van der Laan laanwj@gmail.com`: 9DEAE0DC7063249FB05474681E4AED62986CD25D   
`unknown`: 9D3CC86A72F8494342EA5FD10A41BDC3F4FAFF1C   
`Will Clark will8clark@gmail.com`: 74E2DEF5D77260B98BC19438099BAD163C70FBFA

> **Comments:**
> **username_2**: It is documented on the website. See "Verify your download" on https://bitcoincore.org/en/download/  
> **username_1**: Ah yes, indeed it is! I incorrectly looked at the community website bitcoin.org. Thanks for the correction  
> **username_2**: bitcoin org hasn't even updated to list 22.0...  
> **username_3**: Signers keys can be verified here: https://github.com/bitcoin/bitcoin/blob/master/contrib/builder-keys/keys.txt  

---

### Answer by username_4 on 2019-06-09. Score: 3

To verify the build/downloaded file see the bitcoin core website: <https://bitcoincore.org/en/download/>.

They have a step by step for each platform under "**Verify your download**"


---

