How to Check That Your Vauz Download Is Genuine
You are about to hand a password manager every login you own, so wanting proof that the file you downloaded is the one we built is an entirely reasonable instinct
Every Vauz release is signed. This article shows you how to check that signature, and — just as importantly — how to confirm that the key you are checking against really belongs to us
Our Public Signing Key
RWTcejyNskGe1Xc8GvEbKjUlI2wPh8XLVcs8Xcd3EraJvmSX7LuX8QQYThis is the whole point of a public key: it is meant to be published as widely as possible. It tells you nothing secret, and it lets anyone confirm a release came from us
Two things worth knowing before you go further:
- It does not change between releases. Save it once, somewhere you control, and reuse it forever. That habit is what makes the check meaningful
- It has nothing to do with your V-Key. It does not encrypt anything, it never touches your vault, and it cannot unlock your data. It only proves a download is ours
Why a Checksum on Its Own Proves Nothing
Plenty of sites publish a checksum next to a download and call it a day. That check is close to worthless, and it is worth understanding why
A checksum and the file it describes usually come from the same place. If both are served from one source, then whoever controls that source controls both halves of the comparison, and a hash will match whatever it is told to match. You verified something, but only that the page agrees with itself
A signature only escapes that circle if the key you check against reaches you by a different route than the file did. Take the key off the same page that served you the installer and you are back to a single source vouching for itself. Take it from somewhere else, and two independent systems now have to agree before the check passes
So the strength of this check lives in where your copy of the key came from, not in the command you run. That is why we publish it in more than one place, and why the next section is worth a minute of your time
If you want the longer version of this argument, we wrote one up on the Sealzi Journal: Here is our signing key — and why one copy of it proves nothing (opens in a new tab)
The strongest version of this is also the easiest: save the key once and reuse that saved copy for every release afterwards. A key already sitting on your machine does not depend on any website being reachable, correct, or honest on the day you check — ours included. Not having to take our word for it is precisely what makes the check worth running
Confirming the Key Is Really Ours
We publish the same key in more than one place, deliberately, so you can compare copies that travel different paths:
| Where | How independent it is |
|---|---|
| The download page (opens in a new tab), under "How do I verify?" | The convenient copy — same host as the installer, so on its own it only confirms the page agrees with itself |
| The file vauz-minisign.pub (opens in a new tab) | Same host again, just easier to save |
| This page, on the Sealzi support site | A separate site from the download page, so simply reading this has already given you a second copy to compare against |
| Our changelog (opens in a new tab) | A permanent page rather than a note attached to one release, so you can find the key without knowing which version you are on |
| Our blog post on the signing key (opens in a new tab) | A dated write-up on a separate site again — and the long-form version of why one copy of a key proves nothing |
A DNS TXT record | Answered by our DNS provider rather than our web host, so it reaches you over genuinely separate infrastructure |
The DNS record is the interesting one. It lives on entirely different infrastructure from the website, so it gives you a second, independent answer to compare against the first:
You should get back a string in this shape, with the same key you saw above:
"v=minisign1; k=RWTcejyNskGe1Xc8GvEbKjUlI2wPh8XLVcs8Xcd3EraJvmSX7LuX8QQY"If the key in DNS matches the key on the download page character for character, two separately run systems agree on it, and you can get on with verifying your file
Verifying Your Download
Step 1: Install minisign (once)
Vauz releases are signed with minisign (opens in a new tab), a small open-source signing tool. You only ever need to do this once
Step 2: Check the signature on the checksum file
Save SHA256SUMS (opens in a new tab) and SHA256SUMS.minisig (opens in a new tab) into the same folder as your installer
On Windows, check the first file's name before going any further. SHA256SUMS has no file extension and browsers tend to add one, so it usually lands as SHA256SUMS.txt. Both steps below look for the original name, and step 2 fails in a thoroughly confusing way if it is wrong — minisign goes looking for a signature called SHA256SUMS.txt.minisig, reports that missing, and never mentions the actual problem
This puts the name back, and does nothing at all if your browser left it alone:
if (Test-Path SHA256SUMS.txt) { Rename-Item SHA256SUMS.txt SHA256SUMS }Then, in that folder — the same command on every platform:
minisign -Vm SHA256SUMS -P RWTcejyNskGe1Xc8GvEbKjUlI2wPh8XLVcs8Xcd3EraJvmSX7LuX8QQYA genuine file gives you this, with the release named in the trusted comment:
Signature and comment signature verified
Trusted comment: Vauz 1.4.2 released 2026-08-19That output means the checksum list really came from us and nobody has altered it. Nobody can produce that signature without our secret key, which never leaves the machine that cuts releases
Step 3: Check your installer against the verified checksums
Now that you trust the checksum list, compare your actual download against it
All three read the expected hash and the filename out of SHA256SUMS, so there is no version number to fill in and no long hex string to compare by eye. Each prints your installer's own filename followed by : OK, whatever it is called on your platform
Both steps matter, and in this order. Step 3 on its own only tells you your download matches a list that anyone could have written. Step 2 is what makes that list trustworthy
What a Failed Check Looks Like
If the key does not match the signature, minisign tells you plainly and refuses to go further:
Signature key id in SHA256SUMS.minisig is D59E41B28D3C7ADC
but the key id in the public key is E7620F1842B4E81FA mismatch at Step 3 instead — a line reading FAILED rather than OK — means the checksum list is genuine but your installer does not match it
Once a release carries more than one installer, the ones you did not download are reported as skipped. That is not a failure — it only means the file is not on your machine, which is exactly right if you are on a different platform. Only FAILED matters
Do not install a file that fails either check, and do not try to work around the warning. Delete it, and write to security@vauz.sealzi.com with the exact output you saw. That is something we want to hear about the same day, and we would far rather look into a false alarm than have you install something we did not build
Most of the time the cause turns out to be dull — an interrupted download, or a SHA256SUMS file saved from an older release than the installer beside it. Re-downloading both files fresh clears up the majority of reports. But it is worth ruling out properly rather than assuming
Common Questions
Do I have to do this every time?
No, and most people never will. But it is recommended. It matters most when you downloaded Vauz from somewhere other than our site, when you are installing on a machine that matters, or when something about the download felt off
Is this the same as my V-Key?
Not at all, and they never interact. Your V-Key unlocks your vault and stays on your device. The signing key is a public value that only proves a download came from us
Why does the key never change?
Because a changed key produces exactly the same error a real attack would, and we do not want to train you to shrug that off. If you ever see a key different from the one on this page, treat it as suspicious rather than as an update
The signature verified but the release is not the version I expected
Look at the trusted comment in the Step 2 output — it names the release the signature covers. If it names an older version than the installer you downloaded, you most likely have a stale SHA256SUMS file. Download it again alongside the installer
Windows says it does not recognise minisign
Almost always because the terminal you are typing in was already open when you installed it. winget puts minisign in as a portable package, and an open terminal does not pick up the change — close it, open a new one, and try again
Related Articles
- Understanding the "Vauz is damaged and cannot be opened" Warning
- Why Vauz Asks for Your V-Key Before Exporting
If any part of this leaves you unsure whether your download is safe, please contact Vauz support and include the commands you ran and the output you got