Verifying Signatures

By verifying the signatures of KeePassXC releases, you can prove the authenticity and integrity of the downloaded file. This guarantees that the file you just downloaded was originally created by the KeePassXC Team and that its contents haven't been tampered with on the way.

A more detailed explanation is available in the Qubes-OS project documentation.

Download Options

Every KeePassXC release is published in a variety of package formats:

  • a *.dmg drag-and-drop installer for macOS
  • an *.msi installer and a *.zip archive with binaries for Windows
  • a self-contained executable *.AppImage for GNU/Linux.
  • a *.tar.xz source tarball

Each of these package files has two related sidecar files, a *.DIGEST and a *.sig that need to be downloaded to the same directory in order for verification to succeed.

Basic integrity check - Linux

Open a terminal window and change directory to the folder you downloaded the files to, e.g. cd /home/username/Downloads

The *.DIGEST file can be used to check your package downloaded correctly, with the following command:

$ shasum -a 256 -c KeePassXC-*-x86_64.AppImage.DIGEST
KeePassXC-*-x86_64.AppImage: OK

The shasum program recalculates the SHA-256 hash digest of the package file and compares it with the value in the .DIGEST file. If they match, this shows the package was downloaded without errors.

Basic integrity check - macOS

Open a terminal window and change directory to the folder you downloaded the files to, e.g. cd /Users/username/Downloads

The *.DIGEST file can be used to check your package downloaded correctly, with the following command:

$ shasum -a 256 -c KeePassXC-*.dmg.DIGEST
KeePassXC-*.dmg.AppImage: OK

The shasum program recalculates the SHA-256 hash digest of the package file and compares it with the value in the .DIGEST file. If they match, this shows the package was downloaded without errors.

Basic integrity check - Windows

Open a PowerShell window (WIN+R, type in powershell, press <enter>) and change directory to the folder you downloaded the files to, e.g. cd C:\Users\username\Downloads

Copy/Paste the following command into the PowerShell window:

(Get-FileHash .\KeePassXC-*-Win64.msi).Hash -eq (Get-Content .\KeePassXC-*-Win64.msi.DIGEST).split(" ")[0].ToUpper()

You should see True appear, if not then the download is invalid or your files are not together.

Verifying Releases - Windows

The Windows installation file is protected by authenticode signature, this means that authenticity and integrity checks are verified directly by Windows when you run the program.

You should see the following dialog with DroidMonkey Apps, LLC as the verified publisher:

To verify a zip file, you must download and install Gpg4win. Then follow the verification directions below.

Checking integrity and authenticity - Linux, macOS, and Windows ZIP

A more thorough check can be made using the *.sig sidecar file. This contains an OpenPGP (GPG) signature created with one of our release keys. Signing files with any other key will give a different signature. Following these verification instructions will ensure the downloaded files really came from us.

Importing the Public Master Key

We will use the gpg program to check the signatures. Before you can do that you need to tell gpg about our public key, by importing it.

On Windows and macOS you will need to install the gpg program. On Windows, we recommend Gpg4win. On macOS we recommend GPG Tools or gnupg installed via HomeBrew.

The KeePassXC public key can be retrieved in any of the ways shown below:

From a specific keyserver
gpg --keyserver keyserver.ubuntu.com --recv-keys CFB4C2166397D0D2
Manual download from our website and import with gpg
gpg --import ./keepassxc_master_signing_key.asc
Fetch via gpg
gpg --fetch-keys https://keepassxc.org/keepassxc_master_signing_key.asc

These are the fingerprints of the master key and the current signing sub keys:

pub   rsa4096 2017-01-03 [SC]
      BF5A669F2272CF4324C1FDA8CFB4C2166397D0D2
uid           [ultimate] KeePassXC Release <release 'AT` keepassxc ^DOT' org>
sub   rsa2048 2017-01-03 [S] [expires: 2021-01-07]
      71D4673D73C7F83C17DAE6A2D8538E98A26FD9C4
sub   rsa2048 2017-01-03 [S] [expires: 2021-01-07]
      AF0AEA44ABAC8F1047733EA7AFF235EEFB5A2517
sub   rsa2048 2017-01-03 [S] [expires: 2021-01-07]
      C1E4CBA3AD78D3AFD894F9E0B7A66F03B59076A8

Notice that we have a master key and some sub keys. The actual signatures are created with one of the sub keys. As the naming implies, they are closely related to one another - importing the master PGP key is sufficient for verifying signatures made with any of its sub keys.

Once you have imported the key, you can decide whether you want to mark it as trusted. This is not strictly necessary for the checks we are making here. For more information, see the Qubes-OS project documentation.

Verifying Releases - Linux

You can verify the authenticity and integrity of a downloaded package from its detached signature by running the following command:

$ gpg --verify KeePassXC-*-x86_64.AppImage.sig

gpg: assuming signed data in 'KeePassXC-2.X.X-x86_64.AppImage'
gpg: Signature made Fri 17 Feb 2017 05:20:55 PM CET
gpg:                using RSA key C1E4CBA3AD78D3AFD894F9E0B7A66F03B59076A8
gpg: Good signature from "KeePassXC Release <release 'AT` keepassxc ^DOT' org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: BF5A 669F 2272 CF43 24C1  FDA8 CFB4 C216 6397 D0D2
     Subkey fingerprint: C1E4 CBA3 AD78 D3AF D894  F9E0 B7A6 6F03 B590 76A8

You want to see that "Good signature" line. It shows the .sig file must have been created from the AppImage file by the sub key with the fingerprint C1E4CBA3AD78D3AFD894F9E0B7A66F03B59076A8.

The warning is there because in this example we have not taken the extra step of trusting that key.

Verifying Releases - macOS

You can verify the authenticity and integrity of a downloaded package from its detached signature by running the following command:

$ gpg --verify KeePassXC-*.dmg.sig

gpg: assuming signed data in 'KeePassXC-2.X.X.dmg'
gpg: Signature made Fri 17 Feb 2017 05:20:55 PM CET
gpg:                using RSA key C1E4CBA3AD78D3AFD894F9E0B7A66F03B59076A8
gpg: Good signature from "KeePassXC Release <release 'AT` keepassxc ^DOT' org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: BF5A 669F 2272 CF43 24C1  FDA8 CFB4 C216 6397 D0D2
     Subkey fingerprint: C1E4 CBA3 AD78 D3AF D894  F9E0 B7A6 6F03 B590 76A8

You want to see that "Good signature" line. It shows the .sig file must have been created from the AppImage file by the sub key with the fingerprint C1E4CBA3AD78D3AFD894F9E0B7A66F03B59076A8.

The warning is there because in this example we have not taken the extra step of trusting that key.

Verifying Releases - Windows ZIP

You can verify the authenticity and integrity of the Windows ZIP file by running the following command in the Windows Command Prompt:

gpg --verify KeePassXC-*-Win64-Portable.zip.sig
        
gpg: assuming signed data in 'KeePassXC-2.X.X-Win64-Portable.zip'
gpg: Signature made Fri 17 Feb 2017 05:20:55 PM CET
gpg:                using RSA key C1E4CBA3AD78D3AFD894F9E0B7A66F03B59076A8
gpg: Good signature from "KeePassXC Release <release 'AT` keepassxc ^DOT' org>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: BF5A 669F 2272 CF43 24C1  FDA8 CFB4 C216 6397 D0D2
     Subkey fingerprint: C1E4 CBA3 AD78 D3AF D894  F9E0 B7A6 6F03 B590 76A8

You want to see that "Good signature" line. It shows the .sig file must have been created from the Windows ZIP file by the sub key with the fingerprint C1E4CBA3AD78D3AFD894F9E0B7A66F03B59076A8.

The warning is there because in this example we have not taken the extra step of trusting that key.

Verification fails!

Don't install the package. First, try downloading again and rechecking. If it is still not working, please let us know about the problem by opening an issue.