Docs › Security

Updates

Biscuit tells you when a new version is out, checks it against our signature, and installs it when you click. Nothing is installed without you.

How Biscuit finds a new version

Every 6 hours, Biscuit reads biscuitwallet.com/updates.json, the list of the latest version for each system. In Tor mode, it reads it from our onion. It follows the third-party data setting: with it disabled, Biscuit doesn’t look. Help › Check for updates checks at once.

When there’s one, a button appears in the status bar. Settings › Display › Hide update notifications hides it.

How it is checked

Biscuit downloads the release’s list of SHA-256 checksums and checks its signature against the Biscuit release key, built into the app. A list signed by anyone else is refused.
It downloads the file for your system and compares its checksum with the list.
Only then does it offer to install.

It’s the same check as verifying a download by hand.

How it is installed

AppImage, portable Windows, Linux tar.gz	The new version is written next to the current one, with the atomic swap helper, and started when you click Restart. Delete the old file once the new one works.
macOS	The app is replaced in place.
Windows installer	The new installer is saved in Downloads and started.
Linux packages	Biscuit tells you; update with your package manager, or install the new package from the download page.

Your wallets aren’t touched by an update. Keeping Biscuit up to date matters: Monero sometimes changes its rules, and old versions stop working.