← Back to insights

Download and update Sparrow wallet the right way

October 13, 2026 · Check your wallet app before you open it, in the terminal and not in the browser. Part 1 is the first download. Part 2 is every update after it.

Sparrow is a wallet app for your computer. A fake copy of the app can steal your bitcoin. So before you open a new download, you check it.

You check two things: who made the file, and that nobody changed it. Sparrow is the example here. The same steps work for other software that comes with a signed list, such as Bitcoin Core.

Why the terminal and not the browser?

	Browser	Terminal
The download link	Comes from the page you landed on	You type the address yourself
A fake website	Controls the link, the steps and the fingerprint you see	Cannot change what you type
Compare the codes	By eye, 64 characters	The computer compares every character
The result	You decide if it looks right	OK or FAILED
An update	Start again on the website	Change one number
A new key	The page shows a new fingerprint, and you can easily accept it	gpg stops and says so

Fake wallet websites exist. Some appear as ads at the top of your search results. In the browser, a fake site controls everything you see: the download link, the steps, and even the fingerprint you compare. In the terminal, you control the address, and two tools do the comparing for you.

A download in the browser is not wrong, if you still check the files. Sparrow's own download page shows how. But when you type the address yourself, there are fewer places for a mistake.

And for updates?

Sparrow tells you when a new version is out, with a link at the bottom of the window. You can trust that notice: it carries a signature, and Sparrow checks it. But when you click the link, Sparrow opens the download page in your browser. You are back on the web.

In the terminal, an update is the same few lines with a new number. And your computer remembers the key you checked the first time. If a new release has a seal from a different key, gpg stops with No public key. A web page cannot do that for you.

How the check works

Think of a sealed letter.

• The developer writes a list of all the release files. Each file gets a unique code on the list. If one byte of the file changes, the code changes too.
• The developer seals the list with a personal seal. That seal is the signature.
• You check the seal. Then you check that the code of your file is on the list.

1. 1The developer's keyThe seal. You check it one time, by eye, in two places.
2. 2Signaturegpg tells you if it is good.
3. 3List of codesOne code for each release file.
4. 4Your appIts code must be on the list.

If one step fails, stop. Do not open the app.

Before you start

• This guide is for a Mac with Apple Silicon (M1 or newer). For other computers, see the end of this page.
• Install gpg, the tool that checks the seal. You do this one time. With Homebrew: brew install gnupg
• Open the Terminal app. Paste one block at a time. Read the result before you go on.
• Use the same Terminal window from start to end.

---

Part 1: the first download

Step 1. Download three files

mkdir -p ~/sparrow && cd ~/sparrow
V=2.5.5
BASE=https://github.com/sparrowwallet/sparrow/releases/download/$V
curl -fLO $BASE/Sparrow-$V-aarch64.dmg
curl -fLO $BASE/sparrow-$V-manifest.txt
curl -fLO $BASE/sparrow-$V-manifest.txt.asc
ls -lh

This makes a folder called sparrow and downloads three files: the app, the list of codes, and the seal.

2.5.5 is the newest version on October 13, 2026. Is there a newer one on sparrowwallet.com? Then change the number in V=2.5.5.

The app is about 92 MB. Is it only a few KB? Then the download failed. Try again.

Step 2. Get the key of Craig Raw

curl -fL https://keybase.io/craigraw/pgp_keys.asc -o craigraw.asc
gpg --import craigraw.asc
gpg --fingerprint D4D0D3202FC06849A257B38DE94618334C674B40

Craig Raw makes Sparrow. This downloads his key from Keybase and gives it to gpg. The last line shows the fingerprint of the key: its unique ID.

D4D0 D320 2FC0 6849 A257
B38D E946 1833 4C67 4B40

Does gpg say No public key? Then you have the wrong key. Stop.

Step 3. Cross-check the fingerprint

Do not trust one source, and that includes this page. Compare the fingerprint on your screen with two other places:

1. Keybase. Open keybase.io/craigraw. Next to the key icon you see E946 1833 4C67 4B40. That is the orange end of the fingerprint above. It must be the same on your screen. Keybase also shows that the owner of this key owns Craig's GitHub and X accounts.
2. Sparrow's own site. Open sparrowwallet.com/download. The full fingerprint is in the part about verifying.

Step 4. Check the seal

gpg --verify sparrow-$V-manifest.txt.asc sparrow-$V-manifest.txt

Look forGood signature from "Craig Raw"

A WARNING line comes after it. That is normal. It only means that you did not sign Craig's key yourself. You checked it by eye in step 3, and that is enough.

Do you see BAD signature? Stop. Delete the files and download them again.

Step 5. Check the app

shasum -a 256 --check --ignore-missing sparrow-$V-manifest.txt

Look forSparrow-2.5.5-aarch64.dmg: OK

OK means the code of your file is on the sealed list. Do you see FAILED? Stop. Delete the app file and download it again.

Step 6. Install

open Sparrow-$V-aarch64.dmg

Drag Sparrow into Applications. Done.

---

Part 2: update

An update is shorter. You already have the key, and you already checked it. So you only download, check and replace.

Step	First time	Update
Download three files	Yes	Yes, new version
Get the key	Yes	No
Cross-check the fingerprint	Yes	No
Check the seal	Yes	Yes
Check the app	Yes	Yes
Install	Drag	Drag, then Replace

Step 1. Is there a new version?

Sparrow shows a notice when a new version is out. You can also ask GitHub:

curl -s https://api.github.com/repos/sparrowwallet/sparrow/releases/latest | grep '"tag_name"'

On October 13, 2026 this shows 2.5.5. Which version do you have? ls ~/sparrow shows what you downloaded last time. Same version? Then you have nothing to do.

Step 2. Download and check

Put the new version in the V= line.

cd ~/sparrow
V=2.5.5
BASE=https://github.com/sparrowwallet/sparrow/releases/download/$V
curl -fLO $BASE/Sparrow-$V-aarch64.dmg
curl -fLO $BASE/sparrow-$V-manifest.txt
curl -fLO $BASE/sparrow-$V-manifest.txt.asc
gpg --verify sparrow-$V-manifest.txt.asc sparrow-$V-manifest.txt
shasum -a 256 --check --ignore-missing sparrow-$V-manifest.txt

Look forGood signature from "Craig Raw" and OK

Step 3. Replace the app

Both there? Then close Sparrow and open the new version:

osascript -e 'quit app "Sparrow"'
open Sparrow-$V-aarch64.dmg

Drag Sparrow into Applications. Your Mac asks if you want to replace the old one. Click Replace.

Your wallets stay. The update changes the app only. Your wallets are in a different folder. Still, make sure your seed words are backed up before you update.

If something looks wrong

---

Why not let Sparrow check other software?

Sparrow has its own checker: Tools → Verify Download. It checks the seal and the code, just like gpg. So why not use it, for example for Bitcoin Core?

• It cannot check itself. Your first Sparrow download needs a tool from somewhere else. Once you have gpg, you can use it for everything.
• It adds a layer of trust. Sparrow comes with 18 keys built in, for example for Bitcoin Core, Electrum, Coldcard, Trezor and SeedSigner. Craig Raw chose these keys. When a download matches one of them, Sparrow shows a green check. You did not cross-check that key yourself. With gpg, you get each key and check its fingerprint yourself.
• Keep the checker apart from what it checks. A fake Sparrow on your computer could also say "verified" for any file. gpg comes from a different source.

Is gpg better tested? Partly. GnuPG has been the standard tool since 1999. Sparrow and Bitcoin Core use it in their own download steps. But Sparrow's checker uses Bouncy Castle, which is also old and widely used. So the library is not the main reason. The main reason is fewer layers of trust: gpg, plus a key you checked yourself.

Sparrow's checker is fine for a quick check. For the software that guards your bitcoin, use gpg.

---

Other computers

The steps are the same. Only the file name changes.

Computer	Sparrow file
Mac with Apple Silicon	Sparrow-$V-aarch64.dmg
Mac with Intel	Sparrow-$V-x86_64.dmg
Linux	sparrowwallet_$V-1_amd64.deb

On Linux, type sha256sum where this guide says shasum -a 256.

On Windows, these commands do not work. Use the steps on Sparrow's download page. The idea is the same: check the key, the seal and the file.

Next step: connect Sparrow to a Bitcoin node over Tor. See Connect to the Bitsaga node.