Torweb how to#
Torweb install#
Torweb download#
Torweb windows#

Tor Browser Developers key is also available on and can be downloaded from. Alternatively, you may use the following command: curl -s |gpg -import.

Torweb download#

If you encounter errors you cannot fix, feel free to download and use this public key instead. Run the following command to refresh the Tor Browser Developers signing key in your local keyring from the keyserver. If you get error messages containing 'No such file or directory', either something went wrong with one of the previous steps, or you forgot that these commands use example file names and yours will be a little different. The result of the command should contain: gpgv: Good signature from 'Tor Browser Developers (signing key) ' tor.keyring ~/Downloads/TorBrowser-12.5-macos_ ~/Downloads/TorBrowser-12.5-macos_įor GNU/Linux users (change 64 to 32 if you have the 32-bit package): gpgv -keyring. or.keyring Downloads orbrowser-install-win64-12.5_ Downloads orbrowser-install-win64-12.5_ALL.exeįor macOS users: gpgv -keyring. Note that these commands use example file names and yours will be different: you will have downloaded a different version than 9.0 and you may not have chosen the English (en-US) version. The examples below assume that you downloaded these two files to your 'Downloads' folder. To verify the signature of the package you downloaded, you will need to download the corresponding '.asc' signature file as well as the installer file itself, and verify it with a command that asks GnuPG to verify the file that you downloaded. tor.keyring doesn't exist after running this command, something has gone wrong and you cannot continue until you've figured out why this didn't work. This command results in the key being saved to a file found at the path. You might be able to import the key using the Workaround (using a public key) section instead.Īfter importing the key, you can save it to a file (identifying it by its fingerprint here): gpg -output. If you get an error message, something has gone wrong and you cannot continue until you've figured out why this didn't work. Uid Tor Browser Developers (signing key) Import the Tor Browser Developers signing key (0圎F6E286DDA85EA2A4BA7DE684E2C6E8793298290): gpg -auto-key-locate nodefault,wkd -locate-keys should show you something like: gpg: key 4E2C6E8793298290: public key 'Tor Browser Developers (signing key) ' imported The Tor Browser team signs Tor Browser releases.

Torweb how to#

How to do this will vary depending on your distribution. In order to verify the signature you will need to type a few commands in a terminal window. If you are using GNU/Linux, then you probably already have GnuPG in your system, as most GNU/Linux distributions come with it preinstalled. In order to verify the signature you will need to type a few commands in the Terminal (under 'Applications').

Torweb install#

If you are using macOS, you can install GPGTools.

Torweb windows#

In order to verify the signature you will need to type a few commands in windows command-line, cmd.exe. If you run Windows, download Gpg4win and run its installer. Installing GnuPGįirst of all you need to have GnuPG installed before you can verify signatures. Therefore every time a new file is uploaded a new signature is generated with a different date.Īs long as you have verified the signature you should not worry that the reported date may vary. Please notice that a signature is dated the moment the package has been signed. We now show how you can verify the downloaded file's digital signature on different operating systems. These are example file names and will not exactly match the file names that you download. This will vary by web browser, but generally you can download this file by right-clicking the 'signature' link and selecting the 'save file as' option.įor example, torbrowser-install-win64-12.5_ALL.exe is accompanied by torbrowser-install-win64-12.5_.

They allow you to verify the file you've downloaded is exactly the one that we intended you to get. Digital signature is a process ensuring that a certain package was generated by its developers and has not been tampered with.īelow we explain why it is important and how to verify that the Tor Browser you download is the one we have created and has not been modified by some attacker.Įach file on our download page is accompanied by a file labelled 'signature' with the same name as the package and the extension '.asc'.