Disclaimer: I am using Windows for this tutorial, but it's identical on Linux and macOS.Every beginner should know about the importance of verifying the origination of the software that we download.
Unlike the real world, where you can't be sure if something that you buy is genuine and you have to use experts to verify it, in the digital world we can verify ourselves everything that we download.
This is a super-quick guide, about verifying the software you download using Sparrow wallet.
Many beginners think about which wallet to use and many have downloaded Sparrow. Kudos! Sparrow is a great wallet. But, let's focus on a specific feature that it supports, which is (as you guessed) the feature to verify downloaded software.
I will download and verify
Mullvad VPN. The process should work symmetrically for the great majority of software.
General infoThis information is intended for the complete beginners and I will try to make it as easy as possible.
In cryptography, there are key-pairs (private & public).
The
private key is used
to sign a file to let the people who download it know that it's genuinely produced by the real creators. The private key, since it has the ability to sign and, therefore, make sensitive operations, needs to stay
private.
On the other hand, the
public key is used by the consumers, to verify that the file is indeed produced by the real creators. Since it's used by the consumers, it can be freely transferred between the producers and the consumers.
The signing process takes place using specific software which we don't need to cover in this tutorial, but the point is, that it generates
a signature.
So, in order to verify that a software is indeed produced by the real developers, we need 3 things:
(a) the software itself, which in windows is normally a
.exe file.
(b) the developer's public key, because it's essentially the proof of their identity.
(c) the signature, with which the developers prove that they have signed the original file.
It's worth noting that it's impossible to generate the same signature without having the private key, so if we have the real signature and public key, we can be sure that the file is indeed signed by the real people.
Specific processEverything that we download here, make sure to save it in the Downloads folder. It's not mandatory, but it will help!
When you visit the
Mullvad Download page, you will be presented with the following page:
Notice the 3 buttons I have included in the red circle. These buttons will provide us with the 3 things that we need (software, public key, signature).
Just click to download the software (the green button) and store it in the Downloads directory. The file should be named
MullvadVPN-2025.5.exe or something similar.
Then, click on the GPG signature (the white button) and store it in the Downloads directory. The file should be named
MullvadVPN-2025.5.exe.asc or something similar.
So, now we have the 2 out of the 3 needed things.
Let's click the "What is this" link, which will guide us here:
Click on the link, and it will start downloading the final piece, which is the public key. Store it in the Downloads directory. The file should be named
mullvad-code-signing.asc or something similar.
Now, you have collected all the pieces of the puzzle. Congrats!
Open up Sparrow wallet and navigate to
Tools -> Verify download.
You will be presented with this screen:
Just import the files, browsing your Downloads folder. You should see this:
Congratulations! Just go ahead and install the software!
