How to Verify the Signature of a Tor Download

Verifying the digital signature of a Tor Browser download is a crucial security practice that ensures your installer is authentic, unaltered, and issued directly by the Tor Project developers. This guide provides a straightforward, step-by-step method to download the required signature files, import the Tor Project’s cryptographic signing keys, and verify the integrity of the software on your system using GnuPG.

1. Download the Installer and Signature File

When downloading the Tor Browser from the official Tor Project website, you must download two files into the same directory:

• The installation file for your operating system (e.g., .exe for Windows, .dmg for macOS, or .tar.xz for Linux).
• The matching signature file ending in .asc (located next to the download link as “Signature”).

2. Install GnuPG (GPG)

To check cryptographic signatures, you need GnuPG installed on your system:

• Linux: Open your terminal and install GPG using your package manager (e.g., sudo apt install gnupg on Debian/Ubuntu or sudo dnf install gnupg on Fedora).
• macOS: Install GPG Suite via Homebrew using brew install gpg-suite or download it directly from GPGTools.
• Windows: Download and install Gpg4win, which includes the necessary command-line and graphical GPG tools.

3. Fetch the Tor Developers Signing Key

Before verifying, you must import the Tor Browser developer signing key into your GPG keyring. Open your command line interface (Terminal or Command Prompt) and run the following command:

gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org

Alternatively, you can manually import the key using its fingerprint:

gpg --keyserver keys.openpgp.org --recv-keys "EF6E 286D DA85 EA8E 4757 D533 D148 3FA6 C3C0 7136"

Verify that the key was successfully imported by checking its fingerprint:

gpg --fingerprint torbrowser@torproject.org

Ensure the output matches the official fingerprint: EF6E 286D DA85 EA8E 4757 D533 D148 3FA6 C3C0 7136.

4. Verify the Downloaded File

Navigate to the directory containing both the installer and the .asc signature file. Run the verification command corresponding to your operating system:

Linux:

gpg --verify tor-browser-linux64-*.tar.xz.asc tor-browser-linux64-*.tar.xz

macOS:

gpg --verify TorBrowser-*.dmg.asc TorBrowser-*.dmg

Windows:

gpg --verify tor-browser-windows-x86_64-*.exe.asc tor-browser-windows-x86_64-*.exe

(Note: Replace the file names with the exact names of the files you downloaded.)

5. Interpret the Output

Review the terminal output to confirm verification status:

• Successful Verification: The output will state gpg: Good signature from "Tor Browser Developers (signing key) <torbrowser@torproject.org>".
• Trust Warning: You may see a warning stating gpg: WARNING: This key is not certified with a trusted signature!. This is normal and simply means you have not personally established a web-of-trust path to the key. As long as you see Good signature and the key ID matches, the download is verified and safe to use.
• Failed Verification: If the output displays BAD signature, do not run or install the file. Delete it immediately and attempt the download again from the official website.