This thread presents basic steps to do verifications. For more details, please read more sources.

There are so many bad guys around, and there are so many phishing sites on which you can see and download dangerous faked cryptocurrency wallets. If you get trapped by faked wallets, I am sure that your funds will be stolen. It's just a matter of time that how long bad guys will steal your fund after you installing and storing your fund in faked wallets.

Days ago, the news about the compromise on Monero site gives me a reminder to make the thread for newbies. Honestly, it is a very good opportunity for me to learn more about verification. Previously, I only knew and did verification for Electrum wallet. Now, when I made this thread, I have read more sources, from Bitcoin Core to Dash, and Monero; and I definitely and fortunately learned more valuable things.

This is another lesson for newbies: Learn first to improve; then help others. From progress to learn and help, you will become more knowledgeable; then you will be more safely in crypto.

Why do you have to verify wallets before using them as storage of your fund?
"Prevention is better than cure".

Basic steps:
You should verify three steps. More things to do if you want (if yes, read more in mentioned sources).

Hash values
Developers' public keys
Verify the installer signature.
All things you use to verify, get them by yourself. Don't trust what I quoted below

Download gpg4win software at https://www.gpg4win.org/
After downloading, checking integrity (verify) the downloaded file first.
Yes, you must verify first, don't trust even you download GPG4win from its official website. It is very terrible for you to download a phishing gpg4win software to verify any cryptocurrency wallets.

You can see how to install gpg4win software Verify binaries on Windows (beginner), here
The full guide is here: https://www.gpg4win.org/package-integrity.html
There are 5 methods to do that. I would like to recommend you to read the section: Download and Install Gpg4win:
Get it SHA1 hash value here: https://www.gpg4win.org/package-integrity.html
Copy and paste the hash value you get from the Command prompt to using Find on that page to compare your hash value with the one provides on official site of gpg42win.

They are matched so I download a legit GPG4win software.

In addition, you can use the Windows PowerShell (Admin) - for Windows 10 - instead of the Command prompt.

Electrum
Download it at: https://electrum.org/#download

Signature: get it here
https://download.electrum.org/3.3.8/electrum-3.3.8-setup.exe.asc

Quote

Search dev key ID on MIT
https://pgp.mit.edu/pks/lookup?op=vindex&search=0x2BD5824B7F9470E6
Electrum dev: 0x2BD5824B7F9470E6

Pub keys of developers
ThomasV's public keys

Quote from: https://raw.githubusercontent.com/spesmilo/electrum/master/pubkeys/ThomasV.asc

Get it hash file

Key pair and verify

You have to enter paraphrase

Import key:
Linux:

Code:

gpg --import ThomasV.asc

Windows

Code:

https://bitzuma.com/posts/how-to-verify-an-electrum-download-on-windows/

MacOs

Code:

https://bitzuma.com/posts/how-to-verify-an-electrum-download-on-mac/

Check fingerprints from third-parties
https://www.youtube.com/watch?v=hjYCXOyDy7Y
Web of Trust: https://en.wikipedia.org/wiki/Web_of_trust

DASH
Download wallet here: https://www.dash.org/downloads and you can also see hash file for Dash Core or Dash Electrum.

Then you can directly use the site: https://keybase.io/verify to verify hash file of Dash Core, for example

Code:

7058b28f5b1028caa862c8a29e34a683f8abacfa6ddd50caf37cb1d1f21ef1dd dashcore-0.14.0.3-aarch64-linux-gnu.tar.gz
37c96f2bf56bef55d5acc980a6ae96c1b6dfc6ad29b4c985f1b3392a9f9ac4bb dashcore-0.14.0.3-arm-linux-gnueabihf.tar.gz
3859e654526bc7171dc613c0de1867b710220feae754d6d58792ef8a37452768 dashcore-0.14.0.3-i686-pc-linux-gnu.tar.gz
8ad9de5ad2a428fff9a1b71e6b711ac0e8132069706902431c4c51bcd5171153 dashcore-0.14.0.3-osx64.tar.gz
8460c124dd2a1943b629ea9c40e99b5e510831edce9e8f6644e3096aa01fac01 dashcore-0.14.0.3-osx.dmg
4743a15824cd0a81d72922ed9318a6de5cba62964a608ae772de578274226751 dashcore-0.14.0.3-osx-unsigned.dmg
65060ea4a38b55e7f1298997be40abab1277b5ffba0e6cf7358d40e49b3f05b8 dashcore-0.14.0.3.tar.gz
adb078691090b62e331d2eb8f2841de2e837f27b6ce8dcfef107cb9682222bd2 dashcore-0.14.0.3-win32-setup.exe
032cb5cec4f09b1a30934ed17fb3bee3b68c73b5b64f93a86fa3cf2605273889 dashcore-0.14.0.3-win32-setup-unsigned.exe
57ae3e71105dfca31a07011c24b849cf616b4ead4491f0f089a04c69f9f023b3 dashcore-0.14.0.3-win32.zip
87a0af9daeb05d33be4e2cb675cb296ab7b6745079c9e65ec79850e31ac0df2f dashcore-0.14.0.3-win64-setup.exe
8783145bcb0439c4ead82f1106978e349e180ee852246897e8aca84201d2aba1 dashcore-0.14.0.3-win64-setup-unsigned.exe
0c3fe9a3658f4b676596154b085793fe6674f4d2c5c6015146f8bcedc883e25a dashcore-0.14.0.3-win64.zip
28d45537e1c982967075742f9f6ff631d6de72d075091d53ff039ed8919714ba dashcore-0.14.0.3-x86_64-linux-gnu.tar.gz

Copy and paste above code (that you get in the SHA256SUMS.asc file) to the box and click verify. If you download a legit wallet, the result will be shown as "Signed by codablock". Click on the name to see who is codablock at https://keybase.io/codablock

You can do this on GPG4win after importing codablock's key too.

Quote from: UdjinM6 on November 21, 2019, 01:01:04 AM

There you go: GPG verification results I get by clicking on dashcore-0.14.0.3-osx.dmg.asc (assuming you have GPG Tools installed and codablock's key imported into it already) on top of Downloads with the binary itself and this signature file on top of Github releases page with both these files lilsted

Dash Github's Tags

Credits to qwizzie and UdjinM6: You can read more details of unofficial guides from two users here

Monero
Follow the guide below to verify both hash file and binary file.

Sources:
https://bitzuma.com/posts/how-to-verify-an-electrum-download-on-windows/
https://bitzuma.com/posts/how-to-verify-an-electrum-download-on-mac/
http://www.differencebetween.net/technology/software-technology/difference-between-pgp-and-gpg/
Verifying Bitcoin Core (theymos). I don't use Bitcoin Core but if you use it, you know what to do: Verify first, don't trust.