Check the fingerprint and the signed list

By the end of this page you will be sure the address list you hold really is ours, not someone pretending to be us.

Tier 2: open internet · Works without internet.

It also works without internet if you already have the files (for example from the offline pack or our NomadNet node).

1. Compare the fingerprint in several places

Write down the fingerprint on this page:
not generated yet
Find the same one in at least two other places: the bottom of irantalk.com, the Telegram bot's pinned message, and the front page of our NomadNet node.
If even one character differs, stop. Use no address, and reach us another way.

You need the small minisign program (on Linux from the package manager, on Windows and macOS from the minisign project page).

Put these three files in one folder: manifest.json, manifest.json.minisig, irantalk.pub. You can get all three from the site, the mirrors, or the files area of our NomadNet node.
Compute the public key's fingerprint and compare it with the one you wrote down (it is shown in lower case, without spaces):
```
tail -n 1 irantalk.pub | base64 -d | sha256sum | cut -c1-32
```
On a Mac, write shasum -a 256 instead of sha256sum.
Check the signature:
```
minisign -Vm manifest.json -p irantalk.pub
```
It must say Signature and comment signature verified, and on the next line IranTalk manifest v and a number.
Any other message means the list was altered or signed with another key. Do not use it.

Sideband and Ratspeak show node hashes. Compare them with Ways to connect; they must match exactly.