Verify a Download

Is this really Vector?

Choose the file you downloaded. It's checked here in your browser and never uploaded anywhere.

Choose a File

or drop it here

Verify it yourself

The file's fingerprint

Every download on Vector's GitHub releases lists its SHA-256 beside it. Work out your file's and compare:

macOS / Linux:  shasum -a 256 <file>
Windows:        certutil -hashfile <file> SHA256

Signed by Vector

From v0.5.0, every release carries SHA256SUMS.txt, signed with the same key Vector's updater trusts. With minisign, download both files from the release, then:

minisign -Vm SHA256SUMS.txt -P RWTk69fh9IfuQI4lHcFW6qflEbiopR5uchPJc7fg1xTCnDI+lExhZ1Mx
shasum -a 256 -c SHA256SUMS.txt --ignore-missing

Built from the public source

Each file also has a build attestation tying it to the exact commit and workflow that built it. With the GitHub CLI:

gh attestation verify <file> -R VectorPrivacy/Vector

Android

Every Vector APK, including the F-Droid build, is signed with one certificate. Its SHA-256 is:

89:BC:6C:8F:61:88:D2:6E:8A:65:0A:CB:CE:BD:30:BE:
72:70:5A:05:C3:84:65:1D:DB:05:F9:AF:FC:06:46:1D

Check an APK with apksigner verify --print-certs <file>, or an installed app with AppVerifier.