Overview

This guide walks you through securely downloading, verifying, and installing Tor Browser on a fresh Linux system. GPG verification ensures the file is authentic and hasn't been tampered with.

ℹ️
Why Verify?

Verifying the GPG signature proves the download came from the Tor Project and wasn't modified by attackers. This is critical for privacy software.

Tor Browser Version: 15.0.2 (update version number in commands as needed)

Step 1: Create a Directory for Tor Browser

First, create a dedicated folder to keep things organized:

Bash 
mkdir -p ~/Downloads/Tor_Browser
cd ~/Downloads/Tor_Browser

Step 2: Download Tor Browser and Signature File

You need two files: the Tor Browser archive and its GPG signature file.

Option A: Download via Browser

  1. Go to: https://www.torproject.org/download/
  2. Download the Linux (64-bit) version
  3. Also download the .asc signature file (click "Signature" link next to the download)
  4. Move both files to your ~/Downloads/Tor_Browser directory

Option B: Download via Terminal (wget)

Bash 
# Download Tor Browser (update version number as needed)
wget https://www.torproject.org/dist/torbrowser/15.0.2/tor-browser-linux-x86_64-15.0.2.tar.xz

# Download the signature file
wget https://www.torproject.org/dist/torbrowser/15.0.2/tor-browser-linux-x86_64-15.0.2.tar.xz.asc

Option C: Download via Terminal (curl)

Bash 
# Download Tor Browser
curl -O https://www.torproject.org/dist/torbrowser/15.0.2/tor-browser-linux-x86_64-15.0.2.tar.xz

# Download the signature file
curl -O https://www.torproject.org/dist/torbrowser/15.0.2/tor-browser-linux-x86_64-15.0.2.tar.xz.asc

Step 3: Verify You Have Both Files

Bash 
ls -la

Expected output:

Output 
tor-browser-linux-x86_64-15.0.2.tar.xz
tor-browser-linux-x86_64-15.0.2.tar.xz.asc

You should see:

  • .tar.xz — The Tor Browser archive
  • .tar.xz.asc — The GPG signature file

Step 4: Import the Tor Browser Developers Signing Key

Method 1: Auto-locate via WKD (Preferred)

Bash 
gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org

Method 2: Import from Keyserver

Bash 
gpg --keyserver keyserver.ubuntu.com --recv-keys EF6E286DDA85EA2A4BA7DE684E2C6E8793298290

Expected output (either method):

Output 
pub   rsa4096 2014-12-15 [C] [expires: 2027-07-15]
      EF6E286DDA85EA2A4BA7DE684E2C6E8793298290
uid           [ unknown] Tor Browser Developers (signing key) <torbrowser@torproject.org>
sub   rsa4096 2024-07-15 [S] [expires: 2026-10-26]
⚠️
Important: Verify the Fingerprint

The fingerprint MUST match exactly:

EF6E 286D DA85 EA2A 4BA7 DE68 4E2C 6E87 9329 8290

Step 5: Verify the Signature

Bash 
gpg --verify tor-browser-linux-x86_64-15.0.2.tar.xz.asc tor-browser-linux-x86_64-15.0.2.tar.xz

Step 6: Interpret the Results

✅ GOOD — Safe to Use

Look for this in the output:

Output 
gpg: Good signature from "Tor Browser Developers (signing key) <torbrowser@torproject.org>"

And verify the primary key fingerprint:

Output 
Primary key fingerprint: EF6E 286D DA85 EA2A 4BA7  DE68 4E2C 6E87 9329 8290
✓
Success!

If you see "Good signature" and the fingerprint matches, your download is authentic. Proceed to extraction.

⚠️ WARNING — Can Be Ignored

This warning is normal and safe to ignore:

Output 
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.

This appears because you haven't personally signed the Tor Project's key in your GPG keyring. It does NOT mean the file is compromised.

❌ BAD — Do Not Use

✕
Critical: Bad Signature

If you see this, DELETE the files immediately and re-download:

gpg: BAD signature from "Tor Browser Developers..."

Step 7: Extract Tor Browser

Bash 
tar -xvf tor-browser-linux-x86_64-15.0.2.tar.xz

This creates a tor-browser directory.

Step 8: Run Tor Browser

Bash 
cd tor-browser
./start-tor-browser.desktop

Or register it with your desktop environment (adds to application menu):

Bash 
./start-tor-browser.desktop --register-app

Step 9: (Optional) Move to Permanent Location

If you want Tor Browser in a standard location:

Bash 
# Move to /opt (system-wide)
sudo mv ~/Downloads/Tor_Browser/tor-browser /opt/tor-browser

# Or keep in home directory
mv ~/Downloads/Tor_Browser/tor-browser ~/tor-browser

Update your launch command accordingly.

Quick Reference: All Commands

📋
Copy-Paste Ready

All commands in one place for quick reference.

Bash 
# 1. Create directory and navigate to it
mkdir -p ~/Downloads/Tor_Browser
cd ~/Downloads/Tor_Browser

# 2. Download files (update version as needed)
wget https://www.torproject.org/dist/torbrowser/15.0.2/tor-browser-linux-x86_64-15.0.2.tar.xz
wget https://www.torproject.org/dist/torbrowser/15.0.2/tor-browser-linux-x86_64-15.0.2.tar.xz.asc

# 3. Import GPG key
gpg --auto-key-locate nodefault,wkd --locate-keys torbrowser@torproject.org

# 4. Verify signature
gpg --verify tor-browser-linux-x86_64-15.0.2.tar.xz.asc tor-browser-linux-x86_64-15.0.2.tar.xz

# 5. Extract (only if verification passed)
tar -xvf tor-browser-linux-x86_64-15.0.2.tar.xz

# 6. Run
cd tor-browser
./start-tor-browser.desktop

Troubleshooting

"gpg: command not found"

Install GPG:

Bash 
sudo apt update
sudo apt install gnupg

"wget: command not found"

Install wget:

Bash 
sudo apt install wget

Key import fails

Try alternative keyservers:

Bash 
gpg --keyserver keys.openpgp.org --recv-keys EF6E286DDA85EA2A4BA7DE684E2C6E8793298290

Or:

Bash 
gpg --keyserver pgp.mit.edu --recv-keys EF6E286DDA85EA2A4BA7DE684E2C6E8793298290

Signature verification fails with "No public key"

The key wasn't imported. Go back to Step 4 and import it.

Official Resources

Notes

  • Always verify downloads before running them
  • The signing key fingerprint may change over time — verify it on the official Tor Project website
  • Update the version number (15.0.2) in commands when downloading newer versions
  • Tor Browser will auto-update itself after installation