Before you write a Parrot Linux ISO to a USB drive, check that the file is complete and that it really comes from the Parrot project. It takes two minutes and protects you against broken downloads, compromised mirrors and fake images. This guide shows the two checks: the GPG signature of the hash list, and the SHA-256 or SHA-512 hash of your ISO.
Why both checks matter
- A hash proves that your file matches a list of hashes. It does not prove who wrote that list.
- A signature proves that the list was signed with the Parrot project’s key and has not been changed since.
So verify the signature of the hash list first, then compare your ISO’s hash with that list. A signature cannot tell you a program is safe, only that it comes unchanged from the people who signed it.
1. Download the signed hash list
Each release folder on the official mirrors contains a file called signed-hashes.txt next to the ISO images, for example parrot/iso/7.0/signed-hashes.txt. Download the one for your version into the same folder as your ISO. The download guide links to the official download page.
2. Import the Parrot signing key
wget -q -O - https://deb.parrot.sh/parrot/misc/parrotsec.gpg | gpg --import
If GnuPG warns about unsafe permissions the first time, fix them with:
chmod --recursive og-rwx ~/.gnupg
3. Verify the signature
gpg --verify signed-hashes.txt
Look for Good signature in the output, and compare the key fingerprint it prints with the fingerprint published in the Parrot project’s own documentation. The project rotated its signing keys in January 2025, so older guides show a different key.
A line such as “WARNING: This key is not certified with a trusted signature” is normal: it only means you have not personally signed the Parrot key. What matters is Good signature plus a matching fingerprint. BAD signature means the file was changed: delete it and download it again from another mirror.
4. Check the ISO hash
Compute the hash of your file (SHA-512 or SHA-256; avoid MD5, which is no longer considered secure):
sha512sum Parrot-home-7.1_amd64.iso
Then look up the same file in the list:
grep Parrot-home-7.1_amd64.iso signed-hashes.txt
The two values must be identical. If they differ, the download is damaged or tampered with: download again, ideally from another mirror.
On Windows
certutil -hashfile Parrot-home-7.1_amd64.iso SHA512
To check the signature on Windows, install Gpg4win and run the same gpg commands in a command prompt.
On macOS
shasum -a 512 Parrot-home-7.1_amd64.iso
Install GnuPG with Homebrew (brew install gnupg) for the signature check.
Common problems
- “Can’t check signature: No public key”: the key import in step 2 did not work. Run it again and check your internet connection.
- The hash does not match: the most common cause is an interrupted download. Use a download manager or a torrent, which checks the file as it downloads.
- Your ISO is not in the list: you downloaded the hash list for a different release.
- A signature date older than one you saw before: treat it with suspicion; it can indicate an attempt to serve you an outdated, vulnerable release.
FAQ
Do I really need to verify the ISO?
For a security-focused system, yes. You are about to trust the image with your hardware and your data, and the check takes two minutes.
Is checking the hash enough?
Only if you got the hash from a trusted, signed source. That is why the hash list is signed and why you verify the signature first.
Does this also protect software updates?
Updates are verified automatically: APT checks the signatures of the repository with the Parrot keys installed on your system.