Verify your Holdfast app
Last updated: 16 September 2026
Holdfast is Valigator's non-custodial Solana stake manager. It runs today as a Chrome extension, and a dedicated Android app for the Solana Seeker is being built. This page shows how to make sure the copy of Holdfast you are using really comes from Valigator and has not been altered or repackaged by someone else.
Chrome extension
The Chrome extension is Holdfast's current version, available in private beta. Chrome extensions are distributed and signed through the Chrome Web Store, and Chrome checks that signature on every install and update. Each listing is tied to our developer account and cannot be swapped out by anyone else, so confirming a copy is genuine is simple:
- During the private beta, the extension is an unlisted Chrome Web Store listing. Install it from the direct Chrome Web Store link in your beta invitation, not by searching the store. It is signed and checked by Chrome the same way any Store extension is, so there is no fingerprint for you to check yourself.
- Treat any Holdfast extension from another source as untrusted, and do not install it. That includes a downloaded file, a different store, or a copy you are asked to load by hand.
Android app (Solana Seeker)
The Android app is being built for the Solana Seeker and will be published through the Solana dApp Store. It has not been released yet. When it is, install it only from the official Solana dApp Store listing, which we will link from this page. That listing is your check: the dApp Store confirms our on-chain publisher record, so an app published under our account is genuinely ours.
For reference, every Holdfast release for Android is signed with Valigator's own release key. Its signing certificate has this SHA-256 fingerprint:
SHA-256
65:C1:D5:F9:C3:CD:E6:FD:1C:98:55:86:44:FA:D4:FA:28:2F:A0:00:26:5D:F5:C8:3C:AD:C4:F2:F9:6E:84:61
- Key type: RSA 4096-bit
- Certificate valid until: 31 January 2054
This fingerprint is the same in every genuine Holdfast build. Tools may print it in lowercase or without the colons; compare the characters themselves, not the case or punctuation. If a copy you have been given shows a different fingerprint, it was not signed by Valigator. Do not install it, and please report it to us.
Why this matters
Holdfast is non-custodial. Your keys stay on your hardware wallet and are never sent anywhere. A tampered or fake build could break that. We publish our signing fingerprint here, on a domain we control, so it can be checked on its own, apart from any store, alongside the Android app's on-chain publisher record on the Solana dApp Store.
Questions
Reach the Valigator team on our contact page, or return to the Holdfast home page.