What you will end up with
This guide installs Sparrow Wallet without creating a wallet, entering recovery words or moving bitcoin. The goal is smaller: obtain the desktop application from the real project, check that the downloaded file matches a signed release record, install it and reach the welcome screen.
The steps use Sparrow 2.5.5, published on 17 September 2026. The official download page and GitHub release both listed that version when checked on 23 September 2026. If a newer version is shown when you follow this guide, use its filenames and manifest instead of copying 2.5.5 blindly.
Verifying a download does not prove that the program is free of bugs. It answers two narrower questions. Was the manifest signed with the release key you expected? Does your installer have the exact hash recorded in that manifest?
Before you start
You need a desktop computer running one of the systems supported by the current release:
- macOS on Apple silicon, or Intel on macOS 11 or later
- Windows 10 or later
- a listed Linux package or standalone archive for Intel/AMD or ARM64
Use the normal desktop application, not Sparrow Server. Server builds are intended for computers without a display.
Keep three files in one folder:
- the installer for your operating system
sparrow-2.5.5-manifest.txtsparrow-2.5.5-manifest.txt.asc
Download all three from the same official Sparrow download page. Do not use an installer attached to an email, chat message or advertisement. The official project also publishes the same binaries under its GitHub releases.
If Sparrow 1.8.3 or later is already installed, the application can verify a new download itself. A first installation needs GnuPG plus the operating system's hash tool. The first route is simpler, so it comes first.
Route A: verify an upgrade inside Sparrow
1. Put the three files together
Move the installer, manifest and manifest signature into the same folder. Their version numbers must match. A 2.5.5 signature must not be used to approve a manifest or installer from another release.
2. Open the verifier
Open your existing Sparrow installation. Drag any one of the three downloaded files onto the application window. You can also open Tools, then Verify Download.
Sparrow's official instructions say the dialog should find the other two files in the same folder. It checks the signature on the manifest, then calculates the installer hash and compares it with the signed list.
3. Read every result
Do not stop at one green line. The dialog should identify the signer as Craig Raw, say the release hash matched the manifest and identify the exact installer as ready to install.
The signing key published by the Sparrow repository has this full fingerprint:
D4D0 D320 2FC0 6849 A257 B38D E946 1833 4C67 4B40
The name beside a key is a label. The fingerprint is the stable identifier to compare. Check it against more than the downloaded signature itself, such as the project's repository README and the official download page.
If the signer, fingerprint or hash does not match, stop. Do not open the installer to see whether it works.
Route B: verify a first installation
This route uses the command line because there is no trusted Sparrow installation yet. Install GnuPG from its normal source for your operating system. The Sparrow download page links to GPG Suite for macOS and Gpg4win for Windows; many Linux distributions include gpg already.
1. Import the published release key
Sparrow publishes Craig Raw's public key through Keybase. The project's current command is:
curl https://keybase.io/craigraw/pgp_keys.asc | gpg --import
Importing a key is not the same as trusting it. Display its fingerprint and compare all 40 hexadecimal characters with the fingerprint above:
gpg --fingerprint E94618334C674B40
If the output differs, stop. Do not work around the mismatch by importing more keys until a command turns green.
2. Verify the signed manifest
Open a terminal in the folder containing the two manifest files. On macOS or Linux, a Downloads folder might use:
cd ~/Downloads
gpg --verify sparrow-2.5.5-manifest.txt.asc sparrow-2.5.5-manifest.txt
On Windows, use cd to enter the folder where the files were saved, then run the same gpg --verify command.
A successful result says Good signature and names Craig Raw's key. GnuPG may also warn that the key is not certified with a trusted signature. That warning concerns whether your own GnuPG trust database has independently vouched for the identity. It does not replace the fingerprint comparison.
This step authenticates the manifest. It has not checked the installer yet.
3. Match the installer hash
On Linux, run:
sha256sum --check sparrow-2.5.5-manifest.txt --ignore-missing
On current macOS, run:
shasum --check sparrow-2.5.5-manifest.txt --ignore-missing
The line for the installer you downloaded should end in OK. Reports about other missing installers are expected because the manifest covers several operating systems.
On Windows, calculate the hash with the built-in tool documented by Microsoft:
CertUtil -hashfile Sparrow-2.5.5.msi SHA256
Find Sparrow-2.5.5.msi in the signed manifest and compare the complete hash. Do not compare only the beginning or end. If you chose the standalone ZIP, use that filename instead.
Install and stop at the welcome screen
Only after the signature and installer hash both pass should you open the installer. Install Sparrow using the normal process for your operating system. Linux users should use the package that matches both their distribution and processor architecture.
Launch Sparrow. The expected result is a welcome wizard that explains public servers, Bitcoin Core and private Electrum servers. Reaching that screen establishes that the application started. It does not establish a private connection or create a safe wallet.
Stop there for this exercise. Do not create recovery words merely to test the interface. A seed phrase controls funds and should be generated only when you are ready to back it up privately. Never paste one into a website, support chat or verification tool.
Understand the first connection choice
Sparrow can connect through a public server, your own Bitcoin Core node or a private Electrum server. The official quick-start guide says a public server is the simplest way to begin, but it shares public-key information and wallet activity with the server operator.
That privacy tradeoff does not put private keys on the server. It can still reveal which addresses belong to the same wallet. For significant funds, Sparrow recommends a server you trust, such as your own node setup.
You do not need to choose a connection during this installation check. Close the application and plan the wallet and server setup separately.
If something goes wrong
The version numbers differ: delete none of your existing wallets. Return to the official download page and obtain one installer, manifest and signature from the same release.
GnuPG says “BAD signature”: stop. Download the manifest and signature again from the official source. A bad signature is not fixed by skipping to the hash check.
The signature is good but the installer hash fails: stop and remove that installer. The file does not match the signed manifest, even if its name looks correct.
macOS reports many missing files: older macOS versions may not support --ignore-missing. The official instructions say you can omit that option and ignore missing-file lines, but the installer you actually downloaded must still report OK.
Windows SmartScreen or macOS Gatekeeper warns: do not disable security controls just to make the warning disappear. Recheck the source, signature and hash. Operating-system code signing is a separate check from Sparrow's signed manifest.
Sparrow cannot connect after launch: installation verification and server connectivity are separate. The program can work offline for some tasks. Do not respond by entering a seed phrase into another application.
What was and was not verified
The official 2.5.5 release record, downloadable filenames, published asset hashes, signing fingerprint and current verification instructions were checked on 23 September 2026. No release binary was retrieved into this environment, no installer was executed and no wallet was created. The operating-system screens in this guide therefore remain untested here.
The useful outcome is a repeatable boundary: trust the project location, authenticate the manifest, match the installer to that manifest, then install. A familiar filename by itself proves none of those things.