sparrow-wallet.app Independent guide Buy bitcoin to self-custody

Download & verification · reviewed 2026-08-10

Sparrow Wallet download, and how to prove the file is real

The current Sparrow release is 2.5.3, signed on 29 July 2026. There is one place to get it and one procedure that tells you whether what landed in your downloads folder is the software the developer built. This page covers both, then the install details for Ubuntu, other Linux distributions, macOS and Windows.

Buy bitcoin to move into your own wallet

  • Version 2.5.3
  • Windows 10+
  • macOS 11+
  • Linux x86-64 & ARM64
  • Apache 2.0

Unofficial

The short answer

Get it from
sparrowwallet.com/download/ , typed by hand
Also official
GitHub releases for the same project
Fingerprint
D4D0D3202FC06849A257B38DE94618334C674B40
Signed manifest
sparrow-2.5.3-manifest.txt
Abstract representation of a cryptographic key and a wallet file
Illustrative. The only thing that establishes trust in a build is a signature you checked yourself.

Which file do you actually need?

Every published build for release 2.5.3 is listed below with the exact file name it carries in the signed manifest. Pick the tab for the machine you are installing on, not the machine you are browsing from.

  • macOS (Apple silicon)Sparrow-2.5.3-aarch64.dmgM-series Macs
  • macOS (Intel)Sparrow-2.5.3-x86_64.dmgmacOS 11 and later

Verify before you install

Three commands, in this order. The full explanation of what each one proves is in the guide below.

  1. Import the signing key and check the fingerprint character by character: gpg --recv-keys D4D0D3202FC06849A257B38DE94618334C674B40
  2. Verify the signature on the manifest, not on the installer: gpg --verify sparrow-2.5.3-manifest.txt.asc sparrow-2.5.3-manifest.txt
  3. Confirm your file matches the hash listed inside the verified manifest: sha256sum -c sparrow-2.5.3-manifest.txt

File names below are the ones published in the signed manifest for this release. If a site offers you a differently named build, you are not on the official download page.

Source: sparrowwallet.com — download

Two file names, two jobs

The installer is the thing you run. The manifest is a signed list of hashes that describes every installer in the release. You verify the manifest, then use it to judge the installer. Doing it the other way round proves nothing.

Sparrow is desktop software: there is no browser extension and no mobile build to download. See what the desktop app does.

Read this before you search

The download page is where money is stolen

Nobody breaks the encryption. They give you a wallet that was malicious before you ever typed a seed word into it. Three routes account for almost all of it.

Paid search results

Adverts sit above the real result and can point anywhere. A wallet download is exactly the query where an attacker will happily pay per click, because one successful install pays for the whole campaign. Scroll past the ad block, every time.

Typo-squatted domains

Look-alike domains swap a letter, add a hyphen, add a word like "app", "wallet" or "official", or change the ending. The page is a pixel copy of the real one, including a fingerprint and a manifest that verify perfectly against the attacker's own key.

Helpful strangers

A link in a chat group, a comment, a support DM, a QR code in a video description. Anybody who sends you a wallet installer, especially while helping you fix something, should be assumed hostile until the file passes verification.

The rule

Reach the download page by typing the official domain into the address bar, or from a bookmark you made after typing it. Never from an advert, a search result you did not read carefully, or a link somebody sent you.

The centrepiece

Verify the download: PGP signature, then SHA-256 hash

This takes about five minutes the first time and under a minute afterwards. It is the only step on this page that cannot be skipped, because it is the step that decides whether the software holding your keys was written by the developer or by somebody else.

What each command proves

People run these commands without knowing what they establish, which is why a fake site can talk them through "verification" against its own key. The logic is a chain with three links. The fingerprint identifies the key you expect to have signed the release. The signature proves the manifest was produced by the holder of that key and has not been edited since. The hash proves the file on your disk is byte-for-byte the file that manifest describes. Break any link and the other two mean nothing.

This is also why the fingerprint deserves care. Check it against the official download page, and ideally against a copy you saved from a previous release or found in a second independent place. A fingerprint you read off the same page that served you the installer is a weak check, but it is still infinitely better than no check.

  1. Install GnuPG if you do not have it

    Signature checking needs GnuPG. On Debian or Ubuntu run sudo apt install gnupg; on Fedora sudo dnf install gnupg2; on macOS use Homebrew (brew install gnupg) or the GPG Suite package; on Windows install Gpg4win, which gives you a gpg command in PowerShell.

    Confirm it works with gpg --version before you continue.

  2. Import the release signing key

    Fetch the key from a keyserver: gpg --recv-keys D4D0D3202FC06849A257B38DE94618334C674B40. Then print what you actually imported: gpg --fingerprint D4D0D3202FC06849A257B38DE94618334C674B40.

    Compare the 40 characters against the fingerprint published on the official download page. Anyone can upload a key to a keyserver under any name, so the keyserver is a delivery mechanism, not an authority. The fingerprint is the only part that matters, and the signer for this release is Craig Raw .

  3. Download the installer, the manifest and the signature

    From the official download page take three files: the build for your platform, the manifest sparrow-2.5.3-manifest.txt, and its detached signature sparrow-2.5.3-manifest.txt.asc. Put all three in the same folder and open a terminal there.

    Do not mix sources. A manifest from one place and an installer from another proves nothing at all.

  4. Verify the signature on the manifest

    Run gpg --verify sparrow-2.5.3-manifest.txt.asc sparrow-2.5.3-manifest.txt.

    You want a line that reads Good signature from "Craig Raw " followed by a primary key fingerprint that matches step two. A trailing WARNING: This key is not certified with a trusted signature is normal until you sign the key locally; it means "I have not told GnuPG I trust this identity", not "the signature failed". What must never appear is BAD signature. If it does, delete every file and start again from the official domain.

  5. Check your file against the hashes in the manifest

    The manifest is a plain list of SHA-256 hashes, and it is now proven to come from the signer. On Linux run sha256sum --ignore-missing -c sparrow-2.5.3-manifest.txt and look for OK next to your file. On macOS run shasum -a 256 Sparrow-2.5.3-aarch64.dmg and compare the output with the matching line in the manifest. On Windows run certutil -hashfile Sparrow-2.5.3.msi SHA256 and do the same comparison, ignoring letter case.

    Hashes are all-or-nothing. One different character means a different file.

  6. Install, then keep the fingerprint

    Only now run the installer. Save the fingerprint somewhere you control, such as a password manager note, so that next release you are comparing against your own record instead of whatever a web page shows you at the time.

    Then move on to creating the wallet itself: seed and passphrase setup.

If verification fails

Do not install "just this once". A failed signature has three plausible causes: a truncated download, the wrong file pairing, or a build that is not what it claims to be. The first two are free to rule out by downloading again. If a fresh download from the typed domain still fails, stop and treat the machine and the network path as suspect.

Installing, platform by platform

The differences are small but each one has a way of tripping people up. Verify first, then follow the notes for your system.

Ubuntu, Debian and derivatives

Install the package with apt so dependencies and the desktop entry are handled for you: sudo apt install ./sparrowwallet_2.5.3-1_amd64.deb for x86-64, or ./sparrowwallet_2.5.3-1_arm64.deb on ARM64.

The ./ matters. Without it, apt treats the argument as a package name in your configured repositories, does not find it, and tells you the package is missing. That single error is the most common "install Sparrow on Ubuntu" question there is.

Afterwards the application appears in your menu. Upgrading is the same command with the newer file, after verifying that file too.

Fedora, RHEL and openSUSE

Use the rpm: sudo dnf install ./sparrowwallet-2.5.3-1.x86_64.rpm, or the aarch64 rpm on ARM64 hardware. On systems without dnf, sudo rpm -i works the same way.

As with the deb, point the package manager at the local file rather than a repository name. There is no third-party repository you should be adding for this.

The portable Linux tarball

Extract with tar xzf sparrowwallet-2.5.3-x86_64.tar.gz and run the launcher inside the extracted folder. Nothing is written outside that directory and no root access is needed.

This is the build to use on a machine you do not administer, on an immutable distribution, or when you want to keep two versions side by side while testing an upgrade.

macOS: Apple silicon or Intel

Two separate disk images. Apple silicon Macs (M-series) take the aarch64 .dmg; older Intel Macs take the x86_64 one. If you are unsure, check the chip line under Apple menu › About This Mac.

Open the image and drag the application to Applications, as usual. macOS 11 is the minimum. Running the Intel build on Apple silicon works through translation but there is no reason to accept the penalty.

Windows: installer or portable

The .msi is a normal installer and the right default on Windows 10 or later. The .zip is the same application with no installer: unpack it where you like and run it in place, which suits locked-down machines and removable drives.

Hash checking on Windows needs no extra software: certutil -hashfile <file> SHA256 is built in.

ARM64 and Raspberry Pi

ARM64 builds exist in all three Linux formats, so a 64-bit Raspberry Pi 4 or 5 or an ARM server can run the same wallet as a desktop.

The usual motivation is putting the wallet on the machine that already runs your node, which removes the network hop between them. See connecting Sparrow to your own node.

System requirements, honestly

Sparrow is undemanding by wallet standards because it does not validate the chain itself. It asks an Electrum-protocol server for the history of your addresses and builds its view of your balance from that, which is what "lightweight client" means in practice.

Two consequences follow. The install stays small and starts in seconds even on modest hardware. And the server operator can see which addresses you asked about, so the privacy-minded end state is Sparrow talking to a node you run, over Tor if you want it.

It is also worth knowing that Sparrow is a Java/JavaFX application, yet you never install Java. Each build bundles its own runtime, so there is no JDK to manage and no version mismatch to debug.

Compiled from the platform builds and system support published by the Sparrow project.
RequirementWhat you needDetail
WindowsWindows 10 or later.msi installer, or a portable .zip you can run from a folder
macOSmacOS 11 (Big Sur) or laterSeparate .dmg builds for Apple silicon and Intel
Linuxx86-64 or ARM64.deb, .rpm and a self-contained tarball for each architecture
Java runtimeNone to installSparrow is a Java/JavaFX application, but every published build bundles its own runtime. You do not install a JDK.
Disk spaceModestIt is a lightweight client: it stores your wallet file and a transaction cache, not the blockchain.
NetworkAn Electrum-protocol serverPublic servers by default, or your own Bitcoin Core / Electrum server. Connect your own node.
LicenceApache 2.0Free software, no accounts, no paid tier, funded by donations

What we recommend

Type the official domain. Take the build that matches your actual hardware. Verify the signature on the manifest and the hash of your file before the installer ever runs. Then keep the fingerprint in your own notes so that the next release is checked against something an attacker cannot edit.

If that sequence feels like a lot of ceremony for a free program, reframe it: you are not protecting the download, you are protecting everything you will ever put behind it. The verification habit costs a minute per release and eliminates the single most successful attack against self-custody users.

Next, before you create a wallet, decide how you will store the recovery words and whether you want a passphrase, because those choices are much harder to change later. Continue to seed and passphrase setup, or read how Sparrow protects a wallet file first.

Download questions people actually ask

What is the latest version of Sparrow Wallet?

The current release is 2.5.3, signed on 29 July 2026 according to the official download page. Version numbers move, so treat any figure on a third-party page (including this one) as a hint and confirm it against the official manifest for the build you are about to run.

Where is the official Sparrow Wallet download?

One domain: sparrowwallet.com/download/. The project also publishes source code and release artefacts on GitHub under sparrowwallet/sparrow. Type the domain yourself rather than following a search advert, a forum link or a message from a stranger.

How do I install Sparrow Wallet on Ubuntu?

Download the ARM64 or x86-64 .deb for your machine, verify it, then run sudo apt install ./sparrowwallet_2.5.3-1_amd64.deb from the folder holding the file. The leading ./ is not optional: without it apt looks for a repository package by that name and fails. Debian, Linux Mint and Pop!_OS behave the same way.

Do I need to install Java first?

No. Sparrow is written against Java and JavaFX, but each published build ships with its own runtime inside it. Installing a system JDK is unnecessary and does not change which runtime the application uses.

Does Sparrow run on a Raspberry Pi?

There are ARM64 builds in all three Linux formats, so a 64-bit Raspberry Pi 4 or 5 or an ARM server can run it. Pairing it with a node on the same machine is the usual reason people do this.

Does Sparrow download the whole blockchain?

No. It is a lightweight client that asks a server for the history of your own addresses. That keeps the install small, and it is also a privacy trade-off: whoever runs the server learns which addresses you care about, which is why running your own is the recommended end state.

Is there an Android or iPhone download?

No. Sparrow is desktop software only, and the apps that appear in mobile stores using its name are impostors. Read the mobile app situation before you install anything on a phone.