How to Check That Your Trezor Firmware Is Authentic and Untampered

13 October 2026

The only reliable way to confirm Trezor firmware is authentic and untampered is to verify its cryptographic signature against a known-good public key published by Trezor’s manufacturer, SatoshiLabs. This process involves downloading the firmware file, checking its hash, and then verifying a detached signature file using a tool such as GnuPG. You do not need to trust the website you downloaded from - only the public key and the signature itself.

Why firmware verification matters

Trezor devices are designed to resist physical tampering, but the firmware that runs on them is software. If an attacker replaces the official firmware with a malicious version - whether by compromising the download server, intercepting your connection, or tricking you into installing a fake update - the device could expose your private keys or sign transactions you did not intend.

Verifying the firmware before installation is the only way to be certain that the code you load is exactly what SatoshiLabs released and has not been modified.

What you will need

• The firmware file from the official Trezor website (trezor.io).
• The corresponding signature file (.asc or .sig).
• The official Trezor public key.
• GnuPG (GPG) installed on your computer. It is preinstalled on most Linux and macOS systems. Windows users can download Gpg4win.

Step-by-Step Verification

1. Download the Official Public Key

SatoshiLabs publishes its signing key on multiple channels. The safest approach is to obtain it from a source you already trust, such as a verified social media account or the company’s official documentation. As of this writing, the key ID is often 0x5341414C or 0xF3A5E1A6, but you should confirm the current fingerprint from the official Trezor site under the "Firmware Verification" section.

Import the key into your GPG keyring:

gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys <KEY_ID>

Replace <KEY_ID> with the current identifier. After importing, check the fingerprint matches what SatoshiLabs publishes:

gpg --fingerprint <KEY_ID>

If the fingerprint does not match exactly, stop. You have the wrong key.

2. Download the Firmware and Signature

Go to trezor.io/firmware and download the firmware file for your model. Also download the matching signature file - usually named firmware.asc or firmware.sig. Keep both files in the same folder.

3. Compute the Firmware Hash

Firmware files are large. Instead of signing the whole file directly, SatoshiLabs signs its hash. You need to compute that hash yourself and compare it to the signed hash.

The command depends on the firmware version, but for recent Trezor firmware, the hash is computed with SHA256:

sha256sum trezor-<model>-<version>.bin

This outputs a long hex string. Write it down or copy it.

4. Verify the Signature

Use GPG to verify that the signature file was created by the private key corresponding to the public key you imported. Run:

gpg --verify firmware.asc trezor-<model>-<version>.bin

GPG will output a line like:

gpg: Good signature from "SatoshiLabs <[email protected]>"

This means the signature is cryptographically valid. It does not mean the firmware is safe - only that it was signed by the holder of the private key. If you have the correct public key, and you trust SatoshiLabs, then a good signature confirms the firmware is authentic.

If you see "BAD signature" or "Can't check signature: No public key," the firmware is not authentic. Do not install it.

Installing Verified Firmware

Once you have confirmed a good signature, you can install the firmware through Trezor Suite or by copying the .bin file to the device’s bootloader mode. The device itself will also show a hash of the new firmware on its screen during installation; you can compare that to the hash you computed earlier as an additional check.

What about automatic updates?

Trezor Suite checks firmware signatures automatically when you update through its interface. In normal use, you never see these details. The manual process above is only needed if you download firmware outside of Suite - for example, if you want to install a custom build or need to recover from a corrupted update.

If you only use Suite for updates, the verification is handled for you. But if you ever have reason to doubt the integrity of your computer or network, manual verification provides an independent check.

Common Pitfalls

• Wrong public key. If you import a key from an untrusted source, a bad actor could provide their own key and sign malicious firmware. Always confirm the fingerprint on the official Trezor site or a verified social media channel.
• Missing signature file. The signature file is small and easy to overlook. Without it, you cannot verify anything.
• Outdated GPG. Very old versions of GPG may not support modern signature algorithms. Update if you see errors about unsupported algorithms.
• Confusing hash and signature. The hash tells you what the file contains; the signature tells you who created it. Both are needed.

When to skip this process

If you update firmware through Trezor Suite on a trusted device and network, manual verification is unnecessary. The software does it for you. But if you are installing firmware on a new device for the first time, or if you need to flash firmware from a USB drive on an offline computer, the manual steps above are the only way to be certain.

The Bottom Line

Firmware verification is a matter of trusting a public key, not a website. If you have the correct key and see a good signature, the firmware is authentic. No other method - checking file size, looking at the download URL, or reading forum comments - provides the same level of assurance. The process takes a few minutes and costs nothing. For a device that protects your funds, it is time well spent.

Back to trezor