How to verify a PGP signature (and why it matters for no-KYC swaps)
In short. A PGP signature proves a message, file or address really came from who it claims — and hasn’t been tampered with. For no-KYC users it’s how you confirm a swap’s proof, a wallet download, or that you’re on the real site and not a phishing clone. Verify locally with GnuPG (best), or with a client-side, in-browser checker — and always cross-check the key fingerprint out-of-band.
What a PGP signature proves
A signature gives you two things: authenticity (it was signed by the holder of a specific key) and integrity (not one byte has changed since signing). It does not encrypt or hide anything — that’s a separate feature. Verifying is a read-only check you run on your side.
Why it matters for no-KYC swaps and wallets
When you fund a casino privately, the weak point is often the funding site itself. Phishing clones of popular swaps and wallets are everywhere, and a fake deposit address just sends your coins to a thief. Signatures close that gap:
- Swap proofs. Privacy-focused services such as Xchange.me publish PGP-signed proofs — a signature lets you confirm a statement or address genuinely came from them.
- Wallet downloads. Wallet projects sign their releases so you can verify the binary you downloaded wasn’t swapped for a tampered build.
- Authentic links. A signed list of official addresses tells you which domain or onion is real before you ever connect.
Verify locally with GnuPG (the gold standard)
The most trustworthy method — and the only one that works without JavaScript — is to verify on your own device with GnuPG. Nothing depends on any website being honest:
# import the signer's key once
gpg --import signer.asc
# verify a signed (cleartext) message
gpg --verify message.txt.asc
# verify a file by its detached signature
gpg --verify wallet.tar.gz.sig wallet.tar.gzA good result prints “Good signature from …” with the signer’s name and key fingerprint. That’s only half the job — see the one rule below.
Client-side / in-browser option
If you can’t use GnuPG right now, a client-side verifier that runs entirely in your browser — nothing sent to any server — is a reasonable fallback. The independent xmr.online verify tool does exactly this and also lays out the GnuPG path. Honest caveat: a browser tool is only as trustworthy as the page serving it, so for anything that matters, prefer local GnuPG and cross-check the result. (External tool; not affiliated with us.)
The one rule that matters
Verify the signer’s key fingerprint out-of-band — against several independent sources — before you trust it. A valid signature only proves the message matches that key; if an attacker got you to import their key, a “good signature” means nothing. The fingerprint is the anchor of the whole system.
Bottom line
Verifying a signature takes a minute and saves you from tampered downloads and phishing clones — the exact traps that catch privacy-minded players on the funding step. Learn the GnuPG commands once, always check the fingerprint, and use a client-side checker only as a convenience. For where this fits in a private funding route, see how to fund a no-KYC casino privately and Bitcoin isn’t anonymous.
FAQ
Does a PGP signature encrypt my data?
No. A signature proves who created a message or file and that it hasn’t been altered. Encryption (hiding contents) is a separate PGP feature. Verifying a signature reads nothing private of yours.
Is an in-browser verifier safe?
A client-side verifier that runs entirely in your browser doesn’t send your data anywhere, which is good — but it’s only as trustworthy as the page serving it. For anything important, verify locally with GnuPG, which depends on no website at all.
What if the fingerprint doesn’t match?
Then don’t trust it. A “good signature” from the wrong key is meaningless. Always cross-check the signer’s key fingerprint against several independent sources before you rely on it.