Verify the exact BitBoxApp file you downloaded before opening, extracting, or installing it. Verification succeeds only when GPG reports a good signature for that file and the signing key’s complete primary fingerprint matches the official Shift Crypto signing-key fingerprint.

For the highest assurance, use the manual method below. If command-line verification is a barrier, you can use the AI-assisted method. This reduces the command-line work, but it provides lower assurance because it also requires trust in the AI service.

Signature verification is optional. If you only want to compare the file with the SHA-256 value published for the release, follow the guide to verify the BitBoxApp checksum.

Before manual verification

1. Open the official BitBoxApp releases page on GitHub.
2. Open the release that matches the version in your downloaded BitBoxApp filename.
3. Download the matching .asc signature file from that release.
4. Download the Shift Crypto public signing-key file.
5. Move the signature file into the folder containing the unchanged BitBoxApp installation file.
6. Move the public-key file into the same folder.

The installation file and signature file must have the same base filename. The signature filename has the additional .asc ending.

Example:

BitBox-version-macOS.dmg
BitBox-version-macOS.dmg.asc

Prepare GPG on your operating system

• Windows
• macOS
• Linux
• Android

Windows

1. Install GnuPG from the official Gpg4win website.
2. Select Start.
3. Type cmd.
4. Press Enter to open Command Prompt.
5. Run gpg --version.

Continue when Command Prompt displays the installed GPG version.

macOS

If you use Homebrew:

1. Press Command + Space.
2. Type Terminal.
3. Press Return to open Terminal.
4. Run brew install gnupg.
5. Run gpg --version.

If you do not use Homebrew, install GnuPG from a package source you independently trust. Continue when Terminal displays the installed GPG version.

Linux

1. Open a terminal.
2. Run gpg --version.

If the terminal displays the installed GPG version, continue to the next section. If the command is unavailable:

1. Run sudo apt install gnupg on Debian, Ubuntu, or Linux Mint, or run sudo dnf install gnupg2 on Fedora.
2. Run gpg --version again.

For another Linux distribution, use its official package-management instructions.

Android

The easiest option is to verify the APK on a Windows, macOS, or Linux computer:

1. Download the APK.
2. Download its matching .apk.asc file.
3. Prepare GPG by following the instructions for your computer’s operating system above.
4. Continue with the shared verification steps below.

You can also verify the APK directly on Android with Termux. This path is more advanced and requires Android 7 or later.

1. Save the APK in Android’s Downloads folder.
2. Save the matching .apk.asc file in the same folder.
3. Save the Shift Crypto public-key file in the same folder.
4. Install Termux from F-Droid.
5. Open Termux.
6. Run termux-setup-storage.
7. Allow Termux to access files when Android asks.
8. Run pkg update -y.
9. Run pkg install gnupg -y.
10. Run cd ~/storage/downloads.
11. Run gpg --version.

Continue when Termux displays the installed GPG version. If Termux cannot access the Downloads folder, use the Windows, macOS, or Linux method instead.

How to insert a file path

The commands below ask you to insert file paths without pressing Enter immediately:

Windows

1. Find the requested file in File Explorer.
2. Right-click the file.
3. Select Copy as path. Hold Shift while right-clicking if this option is not shown.
4. Return to Command Prompt.
5. Paste the copied path.

macOS

1. Find the requested file in Finder.
2. Drag the file into Terminal.

Linux

1. Find the requested file in your file manager.
2. Drag the file into the terminal.

If dragging is not supported, type the complete file path instead.

Android

1. Type the filename in Termux.

To complete a long filename, type its first characters and press Tab.

Inspect the Shift Crypto signing key

1. Type gpg --show-keys --fingerprint followed by one space. Do not press Enter yet.
2. Insert the path to shiftcryptosec-509249B068D215AE.gpg.asc using the method for your operating system.
3. Press Enter.
4. Confirm that the primary key identity is ShiftCrypto Security <security@shiftcrypto.ch>.
5. Confirm that the complete primary fingerprint is:

DD09 E413 0975 0EBF AE0D EF63 5092 49B0 68D2 15AE

Import the verified signing key

1. Type gpg --import followed by one space. Do not press Enter yet.
2. Insert the path to shiftcryptosec-509249B068D215AE.gpg.asc.
3. Press Enter.

GPG should report that the ShiftCrypto Security public key was imported or was already present.

Verify the downloaded BitBoxApp file

1. Type gpg --verify followed by one space. Do not press Enter yet.
2. Insert the path to the matching .asc signature file.
3. Type one space.
4. Insert the path to the BitBoxApp installation file.
5. Press Enter.

The completed command follows this pattern:

gpg --verify "PATH-TO-SIGNATURE-FILE.asc" "PATH-TO-INSTALLATION-FILE"

On Android, verify the APK in the Downloads folder that you intend to install. Do not verify one APK and then install a different copy.

Check the verification result

A successful result contains:

gpg: Good signature from "ShiftCrypto Security <security@shiftcrypto.ch>"

Confirm again that the signing key has this complete primary fingerprint:

DD09 E413 0975 0EBF AE0D EF63 5092 49B0 68D2 15AE

If the verification output does not show the complete fingerprint, run gpg --fingerprint security@shiftcrypto.ch and compare it again.

GPG may warn that the key is not certified with a trusted signature. This refers to your local GPG trust database. It does not invalidate a good cryptographic signature, but it also does not replace the complete fingerprint comparison.

The following historical screenshots show where the good-signature message and primary fingerprint appear. Use them only as visual orientation; their BitBoxApp versions, filenames, and commands are outdated.

If verification does not succeed

• No public key: return to the fingerprint check and import the inspected key.
• No such file or cannot open: check the file paths and filenames.
• No signed data or missing data file: make sure both matching files are present and insert both paths in the verification command.
• BAD signature: do not open, install, or run the file.
• Different primary fingerprint: do not trust the key or use the installation file.

After a bad signature or fingerprint mismatch:

1. Delete the installation file.
2. Delete the matching signature file.
3. Delete the downloaded public-key file.
4. Open the official BitBoxApp release page independently.
5. Download a fresh matching set.
6. Repeat the verification.

If verification still fails, contact BitBox Support before continuing. Include your operating system, GnuPG version, exact filenames, displayed primary fingerprint, and complete GPG output. Never include recovery words, wallet backups, passwords, passphrases, private keys, PINs, or authentication codes.

Alternative: AI-assisted signature verification

Use this alternative only with an AI model that can process the complete uploaded file, access the web, and execute commands. BitBoxApp installation packages can exceed 200 MB, so some services or models cannot process them. If the model cannot process the complete file, use the manual method.

The BitBoxApp installation file is public, but uploading it sends a copy to the AI provider. Use only a provider whose file-handling and retention terms you accept. Never upload recovery words, wallet backups, passwords, passphrases, private keys, PINs, authentication codes, or other wallet data.

1. Upload the exact unopened BitBoxApp installation file you want to verify.
2. Replace [VERSION] below with the version shown in the filename.
3. Send the prompt.

Attached is a BitBoxApp download for version [VERSION]. Open the official BitBoxSwiss/bitbox-wallet-app GitHub release page for that version, fetch the matching signature and Shift Crypto signing key, and verify the signature against the uploaded file.

Accept the result only if it:

• identifies the exact uploaded filename and matching BitBoxApp release;
• reports a Good signature from ShiftCrypto Security <security@shiftcrypto.ch>; and
• shows this complete primary fingerprint:

DD09 E413 0975 0EBF AE0D EF63 5092 49B0 68D2 15AE

The example also reports a matching SHA-256 checksum and explains that it obtained the key from an alternative source after the official key URL was blocked. A checksum or alternative key source does not replace the good-signature result or the independent comparison of the complete fingerprint.

If the model reports a bad signature, a different fingerprint, the wrong filename or release, or cannot process the complete file, do not open, install, or run it. Use the manual method or contact BitBox Support.