Calculate the SHA-256 checksum of the BitBoxApp file you downloaded before you open, extract, or install it. If the calculated value matches the value published for that exact file, your download matches the file represented by that published value.

A checksum match does not independently prove who published the reference value. If you also want to confirm that Shift Crypto signed the downloaded file, follow the separate guide to verify the BitBoxApp signature.

Before you start

1. Open the official BitBoxApp download page. The page normally presents the download for your operating system. To use a different installer or package, select Other... and choose the required format. You can also download a file from the latest official BitBoxApp release on GitHub.
2. Keep the downloaded installer, DMG, Linux package, AppImage, or APK unchanged. Verify this downloaded file rather than the installed BitBoxApp or extracted contents.
3. On the download page, confirm the displayed BitBoxApp version and select Show checksums below the download options. Copy the SHA-256 value for the exact installer or package you downloaded. On GitHub, use the SHA-256 value displayed for that exact release asset.

Confirm the platform and filename before comparing values. A Windows installer checksum cannot be used for a macOS DMG, Linux package, AppImage, Android APK, or a file from another release.

Calculate the SHA-256 checksum

Windows

1. Press Windows key + R, enter powershell, and press Enter.
2. Enter Get-FileHash -Algorithm SHA256 , including the final space.
3. Drag the downloaded BitBoxApp installer from File Explorer into the PowerShell window to insert its path. If dragging does not insert the path, right-click the file, select Copy as path, and paste it after the command.
4. Press Enter.

The complete command will look similar to this:

Get-FileHash -Algorithm SHA256 "C:\Users\YourName\Downloads\BitBox-installer.exe"

Use the 64-character value shown in the Hash field.

If you prefer Command Prompt, press Windows key + R, enter cmd, and press Enter. Then run:

certutil -hashfile "C:\Users\YourName\Downloads\BitBox-installer.exe" SHA256

The calculated checksum appears between the command header and the confirmation message.

macOS

1. Open Terminal.
2. Type shasum -a 256 , including the final space.
3. Drag the downloaded BitBoxApp DMG file into the Terminal window to insert its path.
4. Press Return.

The complete command will look similar to this:

shasum -a 256 "/Users/YourName/Downloads/BitBox-macOS.dmg"

The calculated checksum appears before the filename.

Linux

1. Open a terminal.
2. Type sha256sum , including the final space.
3. Add the path of the downloaded DEB, RPM, or AppImage file. Dragging the file into the terminal may insert its path, depending on your desktop environment.
4. Press Enter.

The complete command will look similar to this:

sha256sum "/home/yourname/Downloads/BitBox-x86_64.AppImage"

The calculated checksum appears before the filename. If sha256sum is unavailable but shasum is installed, use shasum -a 256 with the same file path.

Android APK

Android does not provide a standard checksum tool in its regular user interface. To calculate the checksum directly on your phone, you can use the third-party DeadHash app. DeadHash is not developed by Shift Crypto, and its availability or behavior can change.

1. Install DeadHash from Google Play or F-Droid. Before installing it, confirm that the publisher is CodeDead and the package identifier is com.codedead.deadhash.
2. Open DeadHash and make sure SHA-256 is enabled in its hashing settings.
3. Select the downloaded BitBoxApp APK as the file to hash.
4. Use the 64-character SHA-256 value calculated for the APK.

If you prefer not to install another app, transfer the unchanged APK to a Windows, macOS, or Linux computer and use the matching desktop procedure above. You are checking the APK file itself; it does not need to be installed on that computer.

Compare the two values

Compare the locally calculated value with the SHA-256 value published for the exact same BitBoxApp file. Both must contain the same 64 hexadecimal characters in the same order. Uppercase and lowercase letters are equivalent.

If the checksum does not match

1. Confirm that you selected the checksum for the same operating system, package type, filename, and BitBoxApp release.
2. Delete the mismatched file.
3. Open the official BitBoxApp download page independently and download a fresh copy.
4. Calculate and compare the checksum again.

If the fresh download still does not match, stop and contact BitBox Support. Include your operating system, the complete filename, where you downloaded it, and both checksum values. Never include recovery words, a wallet backup, a password, a passphrase, a private key, a PIN, or an authentication code.