Verify your download

SHA-256 Checksum

After downloading, confirm the hash matches. Run this in Terminal:

shasum -a 256 ~/Downloads/BetterPhrase-1.0.0.dmg

Expected hash:

CHECKSUM_PLACEHOLDER (published with first signed release BPH-27)

Checksum will be published here on the first signed release.

Minisign Signature

BetterPhrase releases are signed with minisign. Verify with our public key:

# Install minisign (Homebrew)
brew install minisign

# Verify the release
minisign -Vm BetterPhrase-1.0.0.dmg \
  -P MINISIGN_PUBLIC_KEY_PLACEHOLDER

Signing key and .sig files will be published with the first signed release (BPH-27).

VirusTotal Scan

Every release is submitted to VirusTotal before publishing. Results for the current build:

Build Provenance

BetterPhrase builds are produced from a pinned source commit and built by a GitHub Actions workflow. Provenance attestation follows the SLSA framework.

Full provenance artifacts ship with the first signed release (BPH-27/28).

Questions about verification? Email us.