How to Verify a Kryptor Download: Signature and SHA-256 Checks

Updated

Kryptor's download page publishes a Kryptor signature and a SHA-256 digest next to every pre-built binary (Windows x64, Linux x64/ARM64, macOS x64/ARM64). To verify a download, compare the file's SHA-256 hash against the published digest, then check the .sig file against the binary using Kryptor itself. The official step-by-step instructions live on the project's Installation page, which the download page links to; the outline below follows that documented flow. Verification confirms two things: the file arrived intact, and it was signed by the project's key.

What you need before starting

  • The binary you downloaded (for example, the Windows x64 ZIP) and its matching .sig signature file from the same download row.
  • The published SHA-256 value shown on the download page for that exact file.
  • A way to compute SHA-256 locally: certutil -hashfile <file> SHA256 on Windows, shasum -a 256 <file> on macOS, or sha256sum <file> on Linux.
  • Kryptor itself, to run the signature check. On first use you are trusting the copy you just downloaded, so the digest check matters — do it first.

Step 1: Check the SHA-256 digest

  1. Compute the hash of the downloaded file with the command for your OS above.
  2. Compare the output character-for-character with the SHA-256 value published next to that file on the download page.
  3. If they differ, stop: delete the file and download it again. A mismatch means the download is corrupted or was altered in transit.

This step is a pure integrity check — it does not prove who produced the file, only that it matches the published bytes.

Step 2: Verify the Kryptor signature

  1. Keep the binary and its .sig file in the same folder.
  2. Run Kryptor's signature verification against the binary and the .sig file, following the exact command syntax on the Installation page.
  3. A valid result means the signature was created by the project's signing key and the file has not changed since signing.

If verification fails, do not run the binary. Re-download both the file and its signature, and if it still fails, report it through the project's GitHub page (the documented channel for bugs and support).

Platform notes that affect verification

  • macOS (x64 and ARM64): the download page states there is an upstream .NET SDK issue that prevents libsodium from being bundled into the Kryptor executable, and it is unlikely to be fixed. Until then, you must keep libsodium.dylib (inside the download ZIP) in the same directory as the kryptor file. Verify the binary as downloaded; don't separate the files afterward.
  • Package managers: if you install via Chocolatey (choco install kryptor), Scoop (scoop bucket add extras; scoop install kryptor), AUR (kryptor or kryptor-bin), or NixOS (nix-shell -p kryptor), you are relying on the package channel rather than the download-page digests. The page lists Homebrew for macOS as "help wanted," so no Homebrew package is currently offered.
  • Source builds: the source is on GitHub under GPLv3; signature and digest checks apply to the pre-built binaries, not to a local build.

When verification is worth the extra minute

Do it whenever you will use the binary for backups or file sharing — the stated use case — or move it to another machine. For a quick trial run on a throwaway system, the digest check alone already catches corrupted downloads; the signature check is what ties the file to the project.