Download the Whonix Signing Key for VirtualBox, Source Code and APT Repository
Get Whonix VirtualBox, Source Code and APT Repository OpenPGP signing key. Verify Whonix VirtualBox Downloads, APT Repository and/or Source Code.
Since all Whonix VirtualBox releases are signed with the same key, it is unnecessary to verify the key every time a new release is announced. Trust in the key might gradually increase over time, but cryptographic signatures must still be verified every time a new release is downloaded.
This page is strongly related to the Placing Trust in Whonix page.
- Digital signatures: A tool enhancing download security. Commonly used across the internet.
- Learn more: Curious? Learn more about digital software signatures.
- Optional: Digital signatures are optional. If you've never used them before, there might be no need to start now.
- No worries: New to digital software signatures? It's okay, no need to worry.
- Not a requirement: Not mandatory for using Whonix, but an extra security measure for advanced users.
Download the OpenPGP Key
Optional: Complete the steps below if unfamiliar with GnuPG or if they haven't already been performed.
Have GnuPG initialize your user data folder. 
Set warning free permissions.
chmod --recursive og-rwx ~/.gnupg
Select your operating system.
Windows, macOS, Linux
2. Store the key as
3. Check fingerprints/owners without importing anything.
gpg --keyid-format long --import --import-options show-only --with-fingerprint derivative.asc
4. Verify the output.
The most important check is confirming the key fingerprint exactly matches the output below. 
Key fingerprint = 916B 8D99 C38E AF5E 8ADC 7A2A 8D66 066A 2EEA CCDA
5. Import the key.
gpg --import derivative.asc
The output should include the key was imported.
gpg: Total number processed: 1 gpg: imported: 1
If the Whonix signing key was already imported in the past, the output should include the key is unchanged.
gpg: Total number processed: 1 gpg: unchanged: 1
If the following message appears at the end of the output.
gpg: no ultimately trusted keys found
This extra message does not relate to the Whonix signing key itself, but instead usually means the user has not created an OpenPGP key yet, which is of no importance when verifying virtual machine images.
Analyze the other messages as usual.
6. Web of trust.
Advanced users can check Web of Trust further below for better security.
Kicksecure or Whonix
1. Import the key.
Since the key is already available in Kicksecure or Whonix, importing the key is simpler than for other operating systems.
gpg --import /usr/share/keyrings/derivative.asc
2. Skip a few steps.
Steps 2. to 6. (which would be required for Windows, macOS and other Linux) can be skipped here. Proceed to step 7. below.
Debian and Derivatives
Because it contains the signing key.
sudo apt update && sudo apt full-upgrade
B. Install the
apt command line parameter
--no-install-recommends is in most cases optional.
sudo apt install --no-install-recommends extrepo-offline-data
The procedure of installing package(s)
extrepo-offline-data is complete.
2. Import the key.
Thanks to the
extrepo-offline-data package, the key is already available on the local file system and can be imported into the user's keyring. 
gpg --import /usr/share/extrepo/offline-data/debian/bullseye/whonix.asc
3. Skip a few steps.
Proceed to step 7. below.
7. Complete the Whonix verification steps.
If verifying Whonix images, navigate to the relevant verification page below to finish the process:
OpenPGP Key Features
- sign/verify Whonix VirtualBox images: yes
- sending encrypted e-mails to Whonix developer Patrick: yes
OpenPGP Web of Trust
Jan Dittberner  (Debian Developer)  signed Patrick's key. So did intrigeri (Tails developer, Debian Developer); Peter Palfrader (Debian Developer); Richard King; and Michael Carbone (accessnow.org).
Users relying on Debian or one of the many Debian derivatives (like Ubuntu) already trust apt, the APT repository of the relevant distribution. This means the Debian keyring can be installed as a trusted source for obtaining Jan's, intrigeri's or Peter's key, to check their signature on Patrick's key.
1. Update the package lists.
sudo apt update
2. Install the Debian keyring.
sudo apt install debian-keyring
3. Extract a signer's key from the Debian keyring and import it into your own keyring.
Here is an example using Jan's key.
gpg --no-default-keyring --keyring /usr/share/keyrings/debian-keyring.gpg --armor --export B2FF1D95CE8F7A22DF4CF09BA73E0055558FB8DD | gpg --import
4. Optional: Try to establish a better trust path to the signer by checking signatures on the signer's key.
Check signatures on Patrick's key.
gpg --check-sigs 916B8D99C38EAF5E8ADC7A2A8D66066A2EEACCDA
The output of the above command should show signatures on Patrick's key, which should include the signer's signature.
Download the signify Key
- GnuPG wikipedia - free OpenPGP software.
- Apache: How To OpenPGP.
- Debian: Keysigning - a tutorial on signing keys of other people.
- rubin.ch: An explanation of the PGP web of trust.
When a GPG error is encountered, first try a web search for the relevant error. The security stackexchange website can also help to resolve GPG problems. Describe the problem thoroughly, but be sure it is GPG-related and not specific to Whonix.
More help resources are available on the Support page.
- Verify Whonix Images
- Verifying Software Signatures
- Placing Trust in Whonix
- OpenPGP key distribution strategies
Whonix Main/Project Signing Key wiki page Copyright (C) Amnesia <amnesia at boum dot org>
Whonix Main/Project Signing Key wiki page Copyright (C) 2012 - 2023 ENCRYPTED SUPPORT LP <
@.)Please DO NOT use e-mail for one of the following reasons: Private Contact: Please avoid e-mail whenever possible. (Private Communications Policy) Leaks Submissions: No. (No Leaks Policy) Sponsored posts: No. Paid links: No. SEO reviews: No. >
This program comes with ABSOLUTELY NO WARRANTY; for details see the wiki source code.
This is free software, and you are welcome to redistribute it under certain conditions; see the wiki source code for details.
This will fix eventual
gpg: WARNING: unsafe ownershipwarnings.
- curl --tlsv1.3 --proto =https --max-time 180 --output derivative.asc https://www.whonix.org/keys/derivative.asc
- Minor changes in the output such as new uids (email addresses) or newer expiration dates are inconsequential.
Note to wiki editors:
- Hardcoded to
- This is because at the time
kicksecure.ascwas not yet included in package
- Hardcoded to
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 untrusted comment: Patrick Schleizer firstname.lastname@example.org signify public key RWQ6KRormNEETq+M8IysxRe/HAWlqZRlO8u7ACIiv5poAW0ztsirOjCQ -----BEGIN PGP SIGNATURE----- iQKTBAEBCgB9FiEEbpebKKbzfEO+MK+hy41Qu3e7PEgFAmInQmhfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldDZF OTc5QjI4QTZGMzdDNDNCRTMwQUZBMUNCOEQ1MEJCNzdCQjNDNDgACgkQy41Qu3e7 PEhSyg/+J2R20mA5xVDT0FlZrtHXnNkZzg48FbSteak6utpmd9HGZlTxlEA3ou8z MlDGDHAYgpfe74suqQl2dEql6Mio4YuUou8GW2aEJ+AVa5jRlHMj4H9alTGmUtok UdaCVVQQO/FCE3y1N00TmuxyDghP9dm1cT8mho0P0RbVoqQyMTDIzLiXCa5aPwu/ nyBGwxdVPuGNZ0WYJfKXLRdb/3q2xprYDQOTehLDHnUVins2kKnsbwVTBY4u4575 KQfOwZD176oQZlZOuw6qxhOd0RWF33TMnQXKPjmaTpTjtsbKOascNBqnjDZbDNhl MSmRKvPZ4bi3IbpSsZdRiwXEOEnyeRhqlwhGX8UecU5e31iMRx8vJDA3u2oSQnrZ l8vnFvnnkGe3/COMAAlIEH+bFofFui3QMWYzX5A2g4jHzfgdrYJcNEZmaeptIRJj qs2eteI7FFt/hQaEZimN6TES0o91+JDLQPHDkEbbE8V9qOxUE6+pqLnRmr/uAMbc 3WA73dphJQfBHQOT2k+ByrrZ/h18x5YrMhvr8HB0f8ejU9YiWG/YnbPvvPNuSdQb 1xSaWmWrXpFgDMOJuG0H7uQi+IcZgQj+JsPaMXTZ6ehHyAr50c61TBoG/UzOXTJg YlD+NW0yh7b2XBXsL4Xj0X1lrHBxFGHiaM7zC//pIPKTG7kfyJ4= =n5bK -----END PGP SIGNATURE-----