Verify Tor Browser's signature before installing

Verify Tor Browser's signature before installing

Use this procedure if you have downloaded Tor Browser for Windows, macOS or Linux and want to verify the desktop package before opening it. You will need the package, its detached OpenPGP signature, GnuPG and the Tor Browser Developers signing key. Keep the package unopened while you work. If you are looking for the Android application, follow the Tor Project's Android installation instructions instead. The commands below are for desktop downloads.

Open the Tor Project's desktop download page directly. Select your operating system and, where the page offers a choice, the architecture of your computer. Save the package and then use the signature link next to that same download. Put both files in one folder. The signature normally has the same filename as the package, with an extra .asc suffix. Check the entire name, including the version, platform and architecture. A signature from a previous release will not verify a new package.

If the signature opens as text in your browser, save the linked file using the browser's save-link command. Check that the saved file is the actual signature and that your browser did not save an HTML error page or append another extension. On Windows, showing filename extensions in File Explorer makes this easier. Your downloads folder may contain several copies. Move the pair you intend to verify into a clean folder so you can identify both paths without guessing.

Install GnuPG using the instructions for your operating system in the Tor Project's verification guide. The guide recommends Gpg4win for Windows and uses Command Prompt for its Windows examples. Before continuing, open a terminal or Command Prompt and check that the gpg and gpgv commands are available. If the shell says a command is missing, follow the installation instructions for your platform and reopen the shell.

Use this command to look up the key through the project's Web Key Directory:

gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org

Read the fingerprint shown by GnuPG and compare all of it with the fingerprint in the current official verification instructions. As checked for this draft, those instructions list EF6E286DDA85EA2A4BA7DE684E2C6E8793298290. Use the current documentation if you are following this guide later. The email address and display name alone cannot identify the correct key. If the lookup fails, follow the public-key workaround in the official instructions and make the same fingerprint comparison. If the fingerprints differ or you cannot confirm the fingerprint, stop before verifying the installer.

You can ask GnuPG to show the fingerprint of the imported key explicitly:

gpg --fingerprint EF6E286DDA85EA2A4BA7DE684E2C6E8793298290

Export the verified key into a dedicated keyring in the folder you are using for this check:

gpg --output tor.keyring --export EF6E286DDA85EA2A4BA7DE684E2C6E8793298290

Confirm that tor.keyring exists and is not empty. If a file by that name already exists and you are unsure what it contains, use a new folder and export the verified key there. gpgv treats keys in its verification keyring as trusted, so the fingerprint check and the contents of this file matter.

Open a shell in the folder that contains the package, signature and keyring. Use the signature filename first and the original package filename second. Replace the two sample names below with the names you actually saved. Keep the quotation marks if either path contains spaces.

On macOS or Linux:

gpgv --keyring ./tor.keyring "signature.asc" "downloaded-package"

On Windows in Command Prompt:

gpgv --keyring .\tor.keyring "signature.asc" "downloaded-package"

For example, if the package is named tor-browser-example.exe and the signature is named tor-browser-example.exe.asc, pass tor-browser-example.exe.asc as the first file and tor-browser-example.exe as the second. Those are illustrative names. Use the download page to identify the real pair. The explicit path to tor.keyring tells gpgv which keyring to use for this check.

Look for a successful verification from the Tor Browser Developers signing key. The Tor Project's guide shows example output and explains that a release may be signed at a different time from the example. If the command fails, do not open the package. In a script, check the process exit status as well as the displayed message.

If gpgv cannot open a file, check your current folder and the spelling of the paths. Put paths in quotes and ensure you supplied the signature before the package. Renaming an unchanged file does not alter the signed bytes. A rename can still cause a lookup error or make you choose the wrong file.

If gpgv cannot find a public key, confirm that you exported the verified key and that the keyring path points to that export. A valid-looking key name from a search result is insufficient. Return to the official verification instructions to check the fingerprint or follow the documented workaround.

If gpgv reports a bad signature, recheck that the package and signature came from the same release and platform. Download both again from the official page into a clean folder and repeat the check. An interrupted download, a mismatched pair and a modified package can all lead to failure. If a fresh official pair still fails verification, keep it unopened and consult the Tor Project's support guidance.

### Check again after replacing a download

If you replace either file while troubleshooting, run the verification command again on the new pair. A successful result for an earlier download applies only to the bytes checked in that run. Before installing, confirm that the path you are about to open is the same package path you passed to `gpgv`. This matters particularly when your browser saves a second copy with a numeric suffix and leaves the first copy in the same folder.

A valid signature links the exact bytes you checked to the verified signing key. If you later download another copy, verify that copy before using it. Keep the package in the same folder until you are ready to install, so you do not accidentally open an older unverified copy from elsewhere. Signature verification addresses the provenance and integrity of the download. Browser updates, configuration and how you use the browser remain separate parts of your security. If the terminal prints several messages, read the final result before deciding whether to install. [1]