Before you open or install a downloaded BitBoxApp file, you can check that Shift Crypto signed it and that it has not changed since signing. This guide shows you how to perform that check on Windows, macOS, or Linux, including verification of an Android APK.

The recommended method uses GnuPG, a tool that checks digital signatures locally on your computer. A successful check requires both a Good signature for the exact file you intend to install and a matching fingerprint identifying the official Shift Crypto signing key. A familiar signer name alone is not enough.

You do not need to connect your BitBox or provide wallet information. This check never requires recovery words, a wallet backup, a password, a passphrase, a private key, a PIN, or an authentication code.

If using a command line is a barrier, the optional AI-assisted method at the end adds trust in the AI provider and its report. If you only want to compare your download with a published SHA-256 value, use the separate guide to verify the BitBoxApp checksum. A checksum match alone does not independently authenticate the publisher.

These instructions check the downloaded installation file, rather than an already installed app or an app-store installation.

1. Prepare the files

Signature verification uses three files. Keep them unchanged in one folder:

• The BitBoxApp installation file: the download you intend to install, such as a Windows .exe, macOS .dmg, Linux .AppImage, .deb or .rpm, or Android .apk.
• Its signature file: a small, separate file with the installation file’s complete name followed by .asc. GnuPG uses it to check that exact installation file.
• The public signing-key file: shiftcryptosec-509249B068D215AE.gpg.asc. This lets GnuPG check signatures made by the corresponding signing key. It is public information, not a wallet secret.

The signature file and public-key file both end in .asc, but serve different purposes. The signature belongs to one installation file; the public key identifies the signer. Its fingerprint is the complete identifier you will compare with the official reference.

1. Open the official BitBoxApp releases page on GitHub and find the release matching the version in your downloaded filename.
2. In that release’s Assets section, expand the asset list if necessary. If you have not downloaded the installation file yet, select the file for your operating system and package type. Do not select Source code (zip) or Source code (tar.gz).
3. Download the matching signature: its name must be the installation file’s complete filename followed by .asc. For example, a file ending in .dmg needs its matching .dmg.asc file from the same release.
4. Download the Shift Crypto public signing-key file into the same folder.

GitHub’s Verified badge for a commit or tag does not replace checking the installation file. You will verify the exact downloaded file below; do not check one copy and then install another.

2. Install or find GnuPG

GnuPG provides the gpg command. If it is already installed, open your terminal and run gpg --version. When a GnuPG version appears, continue to stage 3. Otherwise, use the instructions for your verification device below.

Windows

1. Download and install Gpg4win from the official Gpg4win website.
2. Open Command Prompt or PowerShell. If it was open during installation, close it and open a new window so it can find the newly installed command.
3. Run gpg --version. Continue when the installed version appears.

macOS

If you already use Homebrew, open Terminal, run brew install gnupg, and then run gpg --version.

If you do not use Homebrew, open the GnuPG download page and use one of the macOS installers listed under its binary releases. Follow the installer’s instructions, open Terminal, and run gpg --version. Continue when the installed version appears.

Linux

Open a terminal and run gpg --version. If the command is unavailable, install GnuPG through your distribution’s package manager:

• Debian, Ubuntu, or Linux Mint: sudo apt install gnupg
• Fedora: sudo dnf install gnupg2

For another distribution, use its official package manager. Run gpg --version again after installation.

Android APK

The recommended option is to verify the APK on a Windows, macOS, or Linux computer using the corresponding instructions above. You are checking the APK file; you do not install it on the computer. If you transfer it afterward, use that same verified APK on your Android device.

Advanced users can also use Termux directly on Android 7 or later:

1. Save the APK, its matching .apk.asc file, and the public signing-key file in Android’s Downloads folder.
2. Install Termux from F-Droid and open it.
3. Run termux-setup-storage and allow file access when Android asks.
4. Run pkg update, then pkg install gnupg. Confirm the package-manager prompts to complete the update and installation.
5. Run cd ~/storage/downloads, then gpg --version. Continue when the installed version appears.

If Termux cannot access the files, or the commands or storage path differ on your device, perform the check on a computer instead.

If the gpg command is still unavailable

A message such as command not found or gpg is not recognized means the terminal cannot find GnuPG; it is not a signature result. Confirm that installation completed and try a new terminal window. If the command remains unavailable, use the installer’s troubleshooting guidance or contact BitBox Support before continuing.

3. Inspect and import the signing key

First check that the downloaded public key has the expected complete fingerprint. Keep the terminal open for this and the following stages.

1. Run the following command with the path to the public-key file, then press Enter:

gpg --show-keys --fingerprint "PATH-TO/shiftcryptosec-509249B068D215AE.gpg.asc"

2. In the output, find the primary key, shown as pub, and compare the complete fingerprint below it with the official reference below. The expected identity is ShiftCrypto Security <security@shiftcrypto.ch>, but the name and email alone do not authenticate the key.

DD09 E413 0975 0EBF AE0D EF63 5092 49B0 68D2 15AE

This fingerprint is also published in the verification instructions on the official BitBoxApp release page. Compare all 40 characters in order; spacing and letter case do not change the value. Do not use a short key ID as a substitute.

3. Only after the fingerprint matches, import the same public-key file using the command below. GnuPG should report that the public key was imported or was already present.

gpg --import "PATH-TO/shiftcryptosec-509249B068D215AE.gpg.asc"

4. Verify the installation file

Use the matching signature and the exact installation file you intend to use. The signature path comes first, followed by the installation-file path:

gpg --keyid-format none --verify "PATH-TO-SIGNATURE-FILE.asc" "PATH-TO-INSTALLATION-FILE"

1. Type gpg --keyid-format none --verify followed by one space. Insert the signature file’s path, add another space, then insert the installation file’s path.
2. Check that both paths identify the matching pair from the same release, then press Enter. GnuPG reads the files and displays its verification result; it does not install the BitBoxApp.

The --keyid-format none option displays a full fingerprint instead of an abbreviated key ID. Check the result from this command in the next stage.

5. Check the signature and its signer

A successful result includes a Good signature message and the expected signing-key fingerprint. The following excerpt illustrates the relevant lines; dates, language, and surrounding output can vary:

gpg:                using RSA key DD09E41309750EBFAE0DEF63509249B068D215AE
gpg: Good signature from "ShiftCrypto Security <security@shiftcrypto.ch>" [unknown]
Primary key fingerprint: DD09 E413 0975 0EBF AE0D EF63 5092 49B0 68D2 15AE

• Check the signature: GnuPG must report Good signature for the exact installation file supplied in stage 4.
• Check the actual signer: Compare the Primary key fingerprint in that verification output with the reference in stage 3. If no primary-fingerprint line appears, the complete fingerprint on the using RSA key line must match the reference exactly. If neither line lets you confirm the expected key, stop and contact Support.

If the output also reports a bad signature, an expired or revoked key or signature, or another verification error, stop and use the failure guidance below.

Do not replace this comparison with a separate lookup of the expected key: finding that key in your keyring does not establish that it verified this file. A good signature from another key, even one with the same displayed name, does not pass this check.

You may also see This key is not certified with a trusted signature and an [unknown] trust label. These describe your local GnuPG trust database; they do not invalidate a good cryptographic signature. You do not need to change the key’s trust settings to remove the warning. You still need to compare the actual signer’s complete fingerprint.

Verification is complete when both checks pass. You can then continue installing the same verified file, subject to your operating system’s normal security checks. This confirms the file’s signature and integrity; it does not establish that your computer is free of malware or that every action in the app is safe.

These historical Windows and macOS examples show where the good-signature message and primary fingerprint appear. Their versions, filenames, and commands are outdated; use the current two-file command in stage 4 for your own check.

If verification does not succeed

File not found or unreadable

If GnuPG reports No such file or cannot open, confirm that the download completed and check the paths and quotation marks. Use stage 4’s two-file command with the matching signature and installation file. A path error alone is not a reason to delete either file.

No valid OpenPGP data found or no signature found can mean you supplied the wrong file or saved a web page instead of the signature or key. Check which stage failed and download the required file again from its official link. A small file ending in .asc is not necessarily the correct signature.

No public key

GnuPG does not have the key needed for this signature. Return to stage 3, inspect the official public-key file, and import it only if its fingerprint matches. Then repeat stage 4. If the key needed for the signature is different from the expected key, stop.

BAD signature

Do not open, extract, install, or run the installation file. First confirm that the installation file and signature have matching filenames and belong to the same release. If they do not, obtain the correct pair and repeat the check.

If the matching pair still gives a bad signature, delete those two downloaded files, independently open the official BitBoxApp releases page, and download a fresh matching pair. Repeat the verification. You do not need to delete a public key whose complete fingerprint you already checked.

Different fingerprint or another key warning

Do not accept a signature made by a different key or change the expected fingerprint to make the result match. If the downloaded public-key file differs, download it again from the official link and inspect it before importing. If the mismatch remains, or GnuPG reports an expired or revoked key or signature, contact BitBox Support before using the installation file.

Contact BitBox Support

If you cannot complete the check confidently, leave the installation file unopened and contact BitBox Support. Include your operating system, GnuPG version, exact installation and signature filenames, download source, and the verification output including its fingerprint. Review the output for personal folder names before sharing it.

Never include recovery words, wallet backups, passwords, passphrases, private keys, PINs, or authentication codes.

Optional: AI-assisted verification

If local command-line verification is a barrier, a capable AI service can attempt the check on the public installation file you upload. It needs to accept and process the complete file, access the official release online, and execute GnuPG. Some BitBoxApp packages exceed 200 MB, so the method depends on the selected service’s capabilities and limits.

1. Upload the exact unopened BitBoxApp installation file you intend to use.
2. Replace [VERSION] in the prompt below with the version in its filename, then send the prompt.

Attached is a download of the BitBoxApp.

Look at the official BitBoxSwiss/bitbox-wallet-app GitHub release for [VERSION], fetch the key and matching signature, and verify the signature against the uploaded file. Show the command, result, and the actual signer's complete primary-key fingerprint. If you cannot process the complete uploaded file or execute the check, say so.

Before relying on the report, check that it identifies all of the following:

• Your exact uploaded filename and the matching official release.
• The matching .asc signature filename.
• The executed GnuPG command, naming both the signature and uploaded installation file, and the resulting Good signature from ShiftCrypto Security <security@shiftcrypto.ch>.
• The actual signer’s complete primary-key fingerprint: DD09 E413 0975 0EBF AE0D EF63 5092 49B0 68D2 15AE. Compare it yourself with the reference on the official release page.

These details help identify an incomplete or inconsistent report; they do not remove your reliance on the AI provider. A checksum calculation or verification of a different copy downloaded by the service does not verify your uploaded file.

If the service cannot process the complete file or execute the check, reports a bad signature, or gives a different or incomplete fingerprint, filename, or release, do not open or install the file. Use local verification or contact BitBox Support. A reassuring answer is not a substitute for a completed check.