Download and update Sparrow and Specter from the terminal

October 13, 2026 · Two wallet apps, one habit: check the file before you open it. Part 1 is the first download. Part 2 is every update after it.

Sparrow and Specter are desktop apps for your bitcoin wallet. They show your balance, make your transactions and talk to your signing device. A fake copy of the app can send your coins to someone else. So before you open a new download, you check two things: who made the file, and that nobody changed it.

This takes about two minutes in the terminal. You do the full check once. Each update after that uses a shorter version.

How the check works

The developer does not sign the app file itself. The developer makes a list with the hash of every release file, and signs that list. You check the chain from the top down:

1. 1The developer's keyYou check its fingerprint by eye, one time. This is the only step you do with your eyes.
2. 2SignatureThe .asc file. gpg tells you if it is good.
3. 3Hash listSparrow calls it the manifest. Specter calls it SHA256SUMS.
4. 4Your app fileThe .dmg. Its hash must be on the signed list.

If one link in the chain fails, stop. Do not open the app.

Three words you need:

• Hash. A short fingerprint of a file. Change one byte in the file and the hash is completely different.
• Signature. Proof that the owner of a key approved a file, and that nobody changed the file after that.
• Key fingerprint. The unique ID of a key, 40 characters long. Anyone can make a key with the name "Craig Raw". Nobody can make a key with his fingerprint.

Before you start

• This guide uses a Mac with Apple Silicon (M1 or newer). For an Intel Mac or Linux, see Other computers at the end.
• Install GnuPG, the tool that checks signatures. With Homebrew: brew install gnupg. Then gpg --version must show a version number.
• Open the Terminal app. Paste one block at a time, then read the output before you continue.
• Keep the same Terminal window open from step 1 to the end. The later commands use the version that you store in step 1.

Part 1: the first download

Sparrow

Step 1. Download three files

mkdir -p ~/sparrow && cd ~/sparrow
V=2.5.5
BASE=https://github.com/sparrowwallet/sparrow/releases/download/$V
curl -fLO $BASE/Sparrow-$V-aarch64.dmg
curl -fLO $BASE/sparrow-$V-manifest.txt
curl -fLO $BASE/sparrow-$V-manifest.txt.asc
ls -lh

Line by line:

• mkdir -p ~/sparrow && cd ~/sparrow makes a folder called sparrow in your home folder, and goes into it. -p means: no error if the folder is already there.
• V=2.5.5 stores the version number. 2.5.5 is the newest version on October 13, 2026. For a newer one, look at sparrowwallet.com/download.
• BASE=... stores the download address of that version. The shell puts the version in the place of $V.
• curl -fLO downloads a file. -f stops on an error, so you do not save an error page by accident. -L follows the redirect from GitHub to its file server. -O keeps the original file name.
• The three files are the app, the manifest (the hash list) and the signature of the manifest.
• ls -lh shows the files and their size.

The app is about 92 MB. The other two files are small, less than 2 KB each. If the app file is only a few KB, the download failed. Do the step again.

Step 2. Get the key of the developer

curl -fL https://keybase.io/craigraw/pgp_keys.asc -o craigraw.asc
head -1 craigraw.asc
gpg --import craigraw.asc
gpg --fingerprint D4D0D3202FC06849A257B38DE94618334C674B40

• Craig Raw makes Sparrow. He signs every release with his key. The first line downloads his public key from Keybase. -o sets the file name.
• head -1 shows the first line of the file. It must be -----BEGIN PGP PUBLIC KEY BLOCK-----. If you see something else, such as HTML, the download failed.
• gpg --import adds the key to your keyring, the list of keys that gpg knows. gpg shows public key "Craig Raw <craig@sparrowwallet.com>" imported.
• gpg --fingerprint asks gpg for the key with exactly this fingerprint.

You should see

pub   rsa4096 2019-10-03 [SC] [expires: 2027-09-18]
      D4D0 D320 2FC0 6849 A257  B38D E946 1833 4C67 4B40
uid           [ unknown] Craig Raw <craig@sparrowwallet.com>
sub   rsa4096 2019-10-03 [E] [expires: 2027-09-18]

If gpg says No public key, the key you imported is not this key. Stop, delete craigraw.asc and do step 2 again.

Step 3. Check the fingerprint by eye

A computer cannot do this step for you. Compare the fingerprint above with two other sources:

• sparrowwallet.com/download, in the verification part of the page.
• keybase.io/craigraw.

Compare all 40 characters, not only the start and the end. Do not trust this article alone. Any web page can be changed, and that includes ours.

Step 4. Check the signature

gpg --verify sparrow-$V-manifest.txt.asc sparrow-$V-manifest.txt

This checks that Craig's key signed the manifest, and that nobody changed the manifest after he signed it.

You should see

gpg: Signature made Thu 17 Sep 2026 09:21:01 AM UTC
gpg:                using RSA key D4D0D3202FC06849A257B38DE94618334C674B40
gpg: Good signature from "Craig Raw <craig@sparrowwallet.com>" [unknown]
gpg: Signature notation: manu=2,2.5+1.12,0,3
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: D4D0 D320 2FC0 6849 A257  B38D E946 1833 4C67 4B40

The date and time can look different on your computer. What to look for:

• Good signature: the manifest is genuine. Continue.
• The fingerprint on the last line is the same as in step 3.
• The WARNING is normal. It means that you did not sign Craig's key with a key of your own. You checked his fingerprint by eye in step 3, and that does the same job.
• The Signature notation line is extra data from the signing tool. You can ignore it.
• BAD signature: stop. Do not open the app. Delete the three files and download them again.

Step 5. Check the app file

shasum -a 256 --check --ignore-missing sparrow-$V-manifest.txt

• shasum -a 256 calculates the SHA-256 hash of a file.
• --check reads the manifest and compares each hash in it with the file on your disk.
• --ignore-missing skips the files that you did not download. The manifest has 16 files, one for each type of computer. You have one of them.

You should see

Sparrow-2.5.5-aarch64.dmg: OK

• OK: your file is exactly the file that Craig signed.
• FAILED: your file is different. Do not open it. Delete it and download it again.
• No line with your file name: nothing was checked. Look at the file name with ls.

Step 6. Install

open Sparrow-$V-aarch64.dmg

A Finder window opens. Drag Sparrow into Applications. Then eject the disk image in the Finder sidebar.

Specter

The steps are the same. Only the names change.

Step 1. Download three files

V=v2.1.11
mkdir -p ~/specter/$V && cd ~/specter/$V
BASE=https://github.com/cryptoadvance/specter-desktop/releases/download/$V
curl -fLO $BASE/Specter-$V.dmg
curl -fLO $BASE/SHA256SUMS
curl -fLO $BASE/SHA256SUMS.asc
ls -lh

Two differences from Sparrow:

• Specter versions start with a v: v2.1.11, not 2.1.11. v2.1.11 is the newest version on October 13, 2026. For a newer one, look at specter.solutions/downloads.
• The hash list is always called SHA256SUMS, without a version in the name. So each version gets its own folder. This keeps an old list away from a new one.

The app is about 200 MB. One .dmg works on Apple Silicon and on Intel. The other two files are less than 1 KB each.

Step 2. Get the key of the developer

curl -fL "https://keyserver.ubuntu.com/pks/lookup?op=get&search=0x9dc33ca830589de3b3225c26eef5756b2ea42349" -o specter-signer.asc
head -1 specter-signer.asc
gpg --import specter-signer.asc
gpg --fingerprint 9DC33CA830589DE3B3225C26EEF5756B2EA42349

• Specter signs its releases with a project key called "Specter Signer 2026". The Specter download page links to this copy on the Ubuntu keyserver.
• Keep the quotes around the address. Without them, the shell reads the & and the ? as commands, and cuts the address.
• head -1 must show -----BEGIN PGP PUBLIC KEY BLOCK-----.
• During the import, gpg can say 1 signature not checked due to a missing key. This is normal. That signature comes from the personal key of a developer, which you do not have. The extra check below uses it.

You should see

pub   rsa4096 2026-03-20 [SC] [expires: 2031-03-19]
      9DC3 3CA8 3058 9DE3 B322  5C26 EEF5 756B 2EA4 2349
uid           [ unknown] Specter Signer 2026<noreply@specter.solutions>

Step 3. Check the fingerprint by eye

Compare all 40 characters with the fingerprint on specter.solutions/downloads, in the "Verify signature" part.

Extra check, if you want it. Kim Neunert, a Specter developer, signed the project key with his personal key. You can check that signature:

curl -fL "https://keybase.io/k9ert/pgp_keys.asc?fingerprint=ecc0b4abd74e716f5ade095228b358a8843b0109" -o k9ert.asc
gpg --import k9ert.asc
gpg --check-sigs 9DC33CA830589DE3B3225C26EEF5756B2EA42349

You should see, at the end

sig!3        EEF5756B2EA42349 2026-03-20  [self-signature]
sig!         28B358A8843B0109 2026-03-20  Kim Neunert <k9ert@gmx.de>

The ! means the signature is good. Kim's full fingerprint is ECC0 B4AB D74E 716F 5ADE 0952 28B3 58A8 843B 0109. The Specter download page shows it, and so do his GitHub and Keybase accounts.

Step 4. Check the signature

gpg --verify SHA256SUMS.asc SHA256SUMS

You should see

gpg: Signature made Sun 09 Aug 2026 11:22:54 AM UTC
gpg:                using RSA key 9DC33CA830589DE3B3225C26EEF5756B2EA42349
gpg: Good signature from "Specter Signer 2026<noreply@specter.solutions>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 9DC3 3CA8 3058 9DE3 B322  5C26 EEF5 756B 2EA4 2349

Good signature and the same fingerprint as in step 3: continue. The WARNING is normal, as with Sparrow.

Step 5. Check the app file

shasum -a 256 --check --ignore-missing SHA256SUMS

You should see

Specter-v2.1.11.dmg: OK

Step 6. Install

open Specter-$V.dmg

Drag Specter into Applications, then eject the disk image.

Part 2: update

An update uses the same checks, with one big difference: you already have the key, and you already checked its fingerprint. The key is the part you trust one time. The signature and the hash, you check every time.

Step 1. Find the newest version

curl -s https://api.github.com/repos/sparrowwallet/sparrow/releases/latest | grep '"tag_name"'
curl -s https://api.github.com/repos/cryptoadvance/specter-desktop/releases/latest | grep '"tag_name"'

This asks GitHub for the latest release of each app, and shows only the version line. -s hides the progress bar. Test versions (pre-releases) are not included.

You should see, on October 13, 2026

  "tag_name": "2.5.5",
  "tag_name": "v2.1.11",

If you used this guide before, ls ~/sparrow and ls ~/specter show the versions you downloaded last time. If the version is the same, you have nothing to do.

Step 2. Update Sparrow

Put the new version in the V= line. The file names include the version, so the new files go into the same ~/sparrow folder.

cd ~/sparrow
V=2.5.5
BASE=https://github.com/sparrowwallet/sparrow/releases/download/$V
curl -fLO $BASE/Sparrow-$V-aarch64.dmg
curl -fLO $BASE/sparrow-$V-manifest.txt
curl -fLO $BASE/sparrow-$V-manifest.txt.asc
gpg --verify sparrow-$V-manifest.txt.asc sparrow-$V-manifest.txt
shasum -a 256 --check --ignore-missing sparrow-$V-manifest.txt

Read the output as in Part 1: Good signature from Craig Raw, the same fingerprint, and your file with OK. Only then replace the app:

osascript -e 'quit app "Sparrow"'
open Sparrow-$V-aarch64.dmg

The first line closes Sparrow. Drag Sparrow into Applications. macOS asks if you want to replace the old version: choose Replace.

Step 3. Update Specter

V=v2.1.11
mkdir -p ~/specter/$V && cd ~/specter/$V
BASE=https://github.com/cryptoadvance/specter-desktop/releases/download/$V
curl -fLO $BASE/Specter-$V.dmg
curl -fLO $BASE/SHA256SUMS
curl -fLO $BASE/SHA256SUMS.asc
gpg --verify SHA256SUMS.asc SHA256SUMS
shasum -a 256 --check --ignore-missing SHA256SUMS

Again a new folder for each version, because SHA256SUMS has the same name in every release. Good signature from Specter Signer 2026 and OK? Then replace the app:

osascript -e 'quit app "Specter"'
open Specter-$V.dmg

Drag Specter into Applications and choose Replace.

Your wallets stay

The update replaces the app only. Your wallets and settings are in a separate folder in your home folder. Before any update, make sure that your seed words are backed up.

When the new version works, you can delete the files of the old version. Each .dmg uses 100 to 200 MB.

Two messages you can see during an update

gpg: Signature made Sun 09 Aug 2026 11:22:54 AM UTC
gpg:                using RSA key 9DC33CA830589DE3B3225C26EEF5756B2EA42349
gpg: Can't check signature: No public key

Other computers

The steps are the same. Change the file name in the curl line and in the install step:

On Linux, use sha256sum --check --ignore-missing in place of shasum -a 256 --check --ignore-missing. Most Linux systems already have gpg. If yours does not: sudo apt install gnupg.

On Windows, these commands do not work as they are. Use the steps on the official download pages. The checks are the same: the key, the signature, the file.

Next step for Sparrow: connect it to a Bitcoin node over Tor. See Connect to the Bitsaga node.