Verify SHA256 checksum

You can verify the SHA256 checksum without installing any additional software.

1. download GPG Suite
   
2. open Terminal app (easiest to find via search on your mac)
   
3. paste shasum -a 256 (note the space at the end)
   
4. drag downloaded GPG Suite dmg file into Terminal
   
5. press enter

The resulting SHA256 checksum must match the SHA256 checksum on https://gpgtools.com

Verify OpenPGP signature

Verifying the OpenPGP signature file requires GPG Suite or MacGPG installed on your mac. We sign each release with our team key. To verify the signature:

1. download GPG Suite
   
2. download OpenPGP signature file from https://gpgtools.com
   
3. if GPG Suite is already installed on your system skip this step, as our public key comes pre-installed with GPG Keychain. Otherwise import our public key
   
4. both dmg and sig file must reside in the same folder
   
5. double-click the signature file and GPG Services will show the verification result

Depending on your settings you will either receive a notification which you can click to see all details or see the verification results right away:

Note how our team key shows fingerprint 85E38F69046B44C1EC9FB07B76D78F0500D026C4 but the signature result shows fingerprint 8C31E5A17DD5D932B448FE1DE8A664480D9E43F5- when you double click our public key in GPG Keychain and then open the Subkeys tab you will find the subkey we use for signing which matches the signature from the verification results.

Untrusted signature is expected and nothing to worry about. This KB-article explains how to verify and sign a key so that the key becomes trusted.

In case our public key has expired, which can happen as it uses an expiration date, select our public key (Fingerprint 85E3 8F69 046B 44C1 EC9F  B07B 76D7 8F05 00D0 26C4) and press Cmd + U or select Key > Update from Key Server from the menu bar. Then the key will be updated from the key server and should be in valid state again.

Verify signature of any file

Signing releases is common and it is routine to verify the signature for downloaded files when using software like Tor Browser, Tails or any software actually.

1. download file
   
2. and corresponding gpg signature file
   
3. import public key, matching the secret key used to generate the signature of the file you are looking to verify, into GPG Keychain
   
4. to ensure the correct public key is used, please compare the fingerprint given on the developers website with the fingerprint of the imported key
   
5. make sure that signature file and file you are looking to verify are located in the same folder
   
6. double-click the signature file and GPG Services will show the verification result