1. Start from the official site
Search ads and lookalike domains regularly impersonate popular wallets. Use the official link on our review page, or type the developer's domain yourself. Bookmark it.
2. Check the SHA-256 hash
Developers publish a hash for every installer. Compute the hash of your download in PowerShell and compare every character:
PS> Get-FileHash .\installer.exe -Algorithm SHA2563. Verify the signature
A hash only proves the file matches the published value. A PGP signature proves who published it. Install Gpg4win, import the developer's key from a source you trust, and verify the signed manifest before trusting its hashes.
4. Never share your seed phrase
No legitimate developer, exchange, support agent or website — including CryptApps — will ever ask for your recovery words. Anyone who does is trying to steal your funds. Write the phrase on paper or steel and keep it offline.
5. Use a hardware wallet for real money
A hardware wallet keeps keys off your PC, so even malware on Windows cannot sign a transaction without your physical confirmation. See hardware wallet apps.