C-01: Browser obtained from the Tor Project and verified

Why this is first

Every other check on this site assumes the software reporting your address bar is telling the truth. A modified browser can display one address while connecting to another, and it can do that without any visible symptom. If this check fails, the rest of the list is decoration.

How to satisfy it

1. Download only from the Tor Project website, typed into the address bar rather than reached through a search result
2. Verify the signature against the Tor Project public key before the first run, following the procedure documented on the same site
3. Reinstall from the official source if you cannot account for where the current copy came from

Why signature verification matters more than it sounds

A download can be intercepted or a mirror can be hostile without the site itself being compromised. The signature is what ties the file in your hands to the people who built it. Checking it takes a few minutes once, and it is the only moment where the question can be settled rather than assumed.

Common ways this fails quietly

• A copy carried across from an old machine years ago with no memory of its origin
• A version installed from a package that was convenient at the time
• A build recommended in a chat as faster or more private
• A mobile application claiming Tor support that is not the real client

Re-checking

This check is run once per installation rather than per session. Run it again after moving to a new machine, after any reinstall, and if you ever find yourself unable to say where the copy came from.