Verify Integrity of MongoDB Packages

The MongoDB release team digitally signs all software packages to certify that a particular MongoDB package is a valid and unaltered MongoDB release. Before installing MongoDB, you should validate the package using either the provided PGP signature or SHA-256 checksum.

PGP signatures provide the strongest guarantees by checking both the authenticity and integrity of a file to prevent tampering.

Cryptographic checksums only validate file integrity to prevent network transmission errors.

MongoDB signs each release branch with a different PGP key. The public key files for each release branch since MongoDB 2.2 are available for download from the key server in both textual .asc and binary .pub formats.


Download the binaries from MongoDB Download Center based on your environment.

For example, to download the 4.4.6 release for macOS through the shell, run this command:

curl -LO
curl -LO

If you have not downloaded and imported the MongoDB 4.4 public key, run these commands:

curl -LO
gpg --import server-4.4.asc

PGP should return this response:

gpg: key 4B7C549A058F8B6B: "MongoDB 4.4 Release Signing Key <>" imported
gpg: Total number processed: 1
gpg: imported: 1

Run this command:

gpg --verify mongodb-macos-x86_64-4.4.6.tgz.sig mongodb-macos-x86_64-4.4.6.tgz

GPG should return this response:

gpg: Signature made Wed Jun 5 03:17:20 2019 EDT
gpg: using RSA key 4B7C549A058F8B6B
gpg: Good signature from "MongoDB 4.4 Release Signing Key <>" [unknown]

If the package is properly signed, but you do not currently trust the signing key in your local trustdb, gpg will also return the following message :

gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: E162 F504 A20C DF15 827F 718D 4B7C 549A 058F 8B6B

If you receive the following error message, confirm that you imported the correct public key:

gpg: Can't check signature: public key not found

Download the binaries from MongoDB Download Center based on your environment.

For example, to download the 4.4.6 release for macOS through the shell, type this command:

curl -LO
curl -LO

Compute the checksum of the package file:

shasum -c mongodb-macos-x86_64-4.4.6.tgz.sha256

which should return the following if the checksum matched the downloaded package:

mongodb-macos-x86_64-4.4.6.tgz: OK

This verifies the MongoDB binary against its SHA256 key.


Download the MongoDB .msi installer. For example, to download the latest version of MongoDB Community Edition:

MongoDB Community Download Center

  1. In the Version dropdown, select 4.4.6 (current release).
  2. In the Platform dropdown, select Windows.
  3. In the Package dropdown, select msi.
  4. Click Download and save the file to your Downloads folder.

Get the public signature file for your MongoDB version.

For example, for the SHA256 signature of the latest version of MongoDB Community Edition:

  1. From, copy the content.
  2. Save the content to a file mongodb-windows-x86_64-4.4.6-signed.msi.sha256 in your Downloads folder.

To compare the signature file to the hash of the MongoDB binary, invoke this Powershell script:

$sigHash = (Get-Content $Env:HomePath\Downloads\mongodb-windows-x86_64-4.4.6-signed.msi.sha256 | Out-String).SubString(0,64).ToUpper(); `
$fileHash = (Get-FileHash $Env:HomePath\Downloads\mongodb-windows-x86_64-4.4.6-signed.msi).Hash.Trim(); `
echo $sigHash; echo $fileHash; `
$sigHash -eq $fileHash

The command outputs three lines:

  • A SHA256 hash that you downloaded directly from MongoDB.
  • A SHA256 hash computed from the MongoDB binary you downloaded from MongoDB.
  • A True or False result depending if the hashes match.

If the hashes match, the MongoDB binary is verified.

Give Feedback

On this page

  • Verify Linux/macOS Packages
  • Verify Windows Packages