Verifying signatures

Mullvad app Windows Linux Installation macOS Desktop PGP

Sist oppdatert: 25. april 2024

To verify the Mullvad Browser instead, go to the guide Verifying Mullvad Browser signature.

This guide explains how you can verify that you have downloaded the authentic Mullvad VPN app installer.

Install GnuPG

First you have to install gpg (GnuPG) version 2.1 or newer. Avoid the legacy 1.4 version of gpg. It will allow you to use the gpg command in the Terminal.

Linux

Many Linux distributions come with gpg already installed. If yours doesn't then you can install it with the default package manager using the package name gnupg2.

macOS

You can install Homebrew and then install gpg by running brew install gnupg. It will allow you to use the gpg command in the Terminal. Another option is to install GPG Suite.

Windows

Download and install Gpg4win. It will allow you to use the gpg command in the Command Prompt and it also comes with a GUI called Kleopatra. This guide uses the Command Prompt.

Download and import the signing key

The fingerprint of our code signing key is A1198702FC3E0A09A9AE5B75D5A1D4F266DE8DDF (with spaces: A119 8702 FC3E 0A09 A9AE 5B75 D5A1 D4F2 66DE 8DDF) and it can be downloaded from our website or by using wget in a Linux Terminal:

wget https://mullvad.net/media/mullvad-code-signing.asc

Then import the key using the following command in the Terminal (Linux, macOS) or Command Prompt (Windows):

gpg --import mullvad-code-signing.asc

You can verify that the key is installed and show its fingerprint using this command:

gpg --fingerprint admin@mullvad.net

Sign the key

Once you have imported the signing key you can sign it with your own key. This step can be skipped, but then a warning will be printed during each file verification saying that the key is not certified with a trusted signature.

If you do not have a pgp key yet then you first have to create one using this command:

gpg --gen-key

Enter your "Real name" (use a fake name if you want to be anonymous) and an "Email address" and enter "O". Then enter a password and click on OK.

To sign our signing key use the following command:

gpg --sign-key admin@mullvad.net

You will see a long message and in the end it shows the following:

pub  rsa4096/D5A1D4F266DE8DDF
     created: 2016-10-27  expires: never       usage: SC  
     trust: unknown       validity: unknown
 Primary key fingerprint: A119 8702 FC3E 0A09 A9AE  5B75 D5A1 D4F2 66DE 8DDF

     Mullvad (code signing) <admin@mullvad.net>

Are you sure that you want to sign this key with your
key "xxx <xxx@xxx.xx>" (xxx)

Enter "y" to sign it and then enter your pgp key password.

Verify the Mullvad VPN app

To verify the Mullvad VPN installer you need the signature file for the same version of the Mullvad VPN app that you downloaded. The signature file is a file with the exact same filename as the app, but with .asc appended at the end. To download the signature file for the Mullvad VPN app, click on the GPG signature button on the Downloads page for your platform.

Make sure to place the signature file and the Mullvad VPN app installer in the same folder.

In this example, we will download the latest Mullvad VPN app for Debian and its signature in the Terminal.

wget --trust-server-names https://mullvad.net/download/app/deb/latest
wget --trust-server-names https://mullvad.net/download/app/deb/latest/signature

Navigate into the folder where the files are with the cd command (if you downloaded the files from our website) and then run the following command:

gpg --verify MullvadVPN-*.deb.asc

If you have multiple .asc files in the same folder then use the full filename or the verification may fail. For example:

gpg --verify MullvadVPN-2023.6_amd64.deb.asc

You should get the following output (the example below is using the Linux file).

gpg: assuming signed data in 'MullvadVPN-2023.6_amd64.deb'
gpg: Signature made Wed Dec  6 14:47:50 2023 CET
gpg:                using RSA key CA83A46153BC58D69518ED49A26581F219C8314C
gpg: Good signature from "Mullvad (code signing) <admin@mullvad.net>" [full]

If it says "checking the trustdb" then run the command again to show the output without that.

Code signing key

Here is the code signing key in plain text: