PGP Key
Our public key, so you can check that a message really came from us. Anyone can copy a website; nobody else can produce this signature.
- Fingerprint
- F288 5293 2BFC 8BFF CCAF EFFE 954C 7306 CDA2 122B
- Key ID
- 954C7306CDA2122B
- User ID
- Vacuum Exchange <[email protected]>
- Type
- RSA 4096
- Created
- 13 August 2026
- Expires
- 12 August 2028
-----BEGIN PGP PUBLIC KEY BLOCK----- mQINBGp94fEBEACsHS9pPspP4ED8ugi7LY4zA2BmLf/L6lFUWBGCmbMN9GR7KSyV P/5i/MGWvNbywnPo+7SmmQimgpqiSAAwlMYYmb3Vaew0C9aElX7jveFEYFpcrI8E MtOnQgbGP/YRt5f0hj+5RyColo9Fyiif/ZjnejLI572O4vjuP98g5bj5FabOmzYL kgoJ6j9jPNHI2W6q/M6Y8JpVoTAd+mETjU01jLp2ruffVTKBvy0hadewDFfGAl9H NLjQdFG6b15Aq/3qo50m8bF2/WSiOrt95Jq5eGRiFQj353PVgapCK4pzCBGFSjPu Phh4kr21fiLVVOxCcPkjdxR5hjnO8zcOvzTJ7qYi46sFY08pEcP3vvrjhmz/+rhA TrBFCqfzoUkaTS0DfCU3nvcrIN7R2Am7nwXTJPQe3cJKaUcuAOgiH04g58mWmYbQ BVpHQ5ZG7Zu1+tIaRDi2z8U+HOOp+Krq/1cdB+A2WRXXIY5mEkHJrETFU3X2sZeO OaxyXsrU2faZxO3AKd13T8wX0kDeuFxGe6SK1vH9bCHeT7Q1x1IAk/VxUt4DFQsL BT8PSEToRn3DPBQ8DG36Na6gbL+FpA0ARLLMuotAOTUL/YZq6WvAiUkPXSw9W1Qt DN/S45+9EboPufTic4FOUmlatHvmsjlPxqwzgxGQ2EXxcwaPskm7ISfk1wARAQAB tClWYWN1dW0gRXhjaGFuZ2UgPHN1cHBvcnRAdmFjdXVtLmV4Y2hhbmdlPokCcwQT AQgAXRYhBPKIUpMr/Iv/zK/v/pVMcwbNohIrBQJqfeHxGxSAAAAAAAQADm1hbnUy LDIuNSsxLjEyLDAsMwIbAwUJA8JnAAULCQgHAgIiAgYVCgkICwIEFgIDAQIeBwIX gAAKCRCVTHMGzaISK/2wEACMN97k3wZjTULPjKAomF+4ewB8s3E0nqfaXK/EY6yG rkOej7KNHJ/IMyq5K7YeMl5unIAxWUUbzKtFm2FIIidfZaDj4drB80MdOTKWRr0J O3qfos5jRFwtqCv/sJ25KOuKE5IeKILH3md5QXyln5UwhAIxO12eL+V4p9UXhZsp xsgvmzukIKbUl7wviDaqQKeq4qmRc6QQ3kxRXr07DGWdxdZNB4TTmozi6CU/GoKd G6hmQ83NyAw0qLtWYZNdI4ll/iNaGRazzO6lcC2DlcA0ey+yd7BZ3qWk8mafzQTl F/t4IpYBDjihzEGi3KyURWTI67mWrf57wo24JLd69uFcljDVoRoglQDWSGALITeW j/ePMhqWpHCTrMLOZUTtcQRzWPdrME8MeXf0H5tb816p7D2GcZKGjpwbr+uck3WF qYYYvwUAqYiVgrXz03IsP51ELfUyF1o8NVQQ1smaUTQ6CSQ20jFIe/9vRRr5GHa/ UM3dJ8lqhrhk5GZ1Dn2vYS+sQK+cjTgE3x7a5cQAiRF++IFMVnH/vcVmVCZr/UQS ApPShkX9Uk5Yj/RXmx1YXSG7bU/5v7djDnTs8cLxuThHAYUU1jLGI+8Xl/4KsVew RVUQMzYp+3mis9otVD6oHtDOBH5yzy7tGOwkbw6E/HDvZlZyqHAPHmFhnhSnYzbl 6bkCDQRqfeIKARAAw9/6MWWDZYy1hggHgAqYoM6ZrzEg3zykuUGoJER/MzhdCgnS KG3CRlRcOZjhuVqDCEIYJ2Gfv4M9aB5gn5mlzIzn9naUsHQISOeE03CAC38bwQnm z0eo4indlvBKE4tFsV0qVRBUiO+pE/+KZllXJdsD9np9oSzS6mkwAnRWhKxW7bbk 6p+vC1TixsRsQeM1nRN2IyRkbu7hV+EmBebotI7ZEVgNTSbYZkQqBWhdJaBUE5m4 BQIj+XMMAHidFQnJMJ43fnR8Iy8RvBJa1caRSX4dzcB+RYzkBAphZmEKTVKg5VBL 5uJMwpIDsaRXDexq2jJUk6XFZbwkUZu0jgt25zO8C09TKSz67Vfujsl4vgisB96B XwdDFAzMEtzribbCGQN+kvJ4DQcctVpid3Fd5UnUYbrUnvwKSHmIdyz2HSf14b5f 3/QNhoc7np1ZjJqcnkgpD6j6H5uNlENON1pltKvG9M12Qt+zGWWWP7rG3PXPjtCY tMvJeub5JbM2l4unatRDrm5/aHDrcRhJBuPR6PMcqmcXod+gC9mvchymirJUqL+p QDeiPmceecg7U7o0Vhb6cE6cTZsI1t6R7fZJMorUl7OaNBVpg3/hLZgot7Cen/Rj svCNvoJjPv4hMx+fdsodnHyXTgDNzdy5D/TQNtvGtE5ie382l7sA6AtVK2MAEQEA AYkCWAQYAQgAQhYhBPKIUpMr/Iv/zK/v/pVMcwbNohIrBQJqfeIKGxSAAAAAAAQA Dm1hbnUyLDIuNSsxLjEyLDAsMwIbDAUJA8JnAAAKCRCVTHMGzaISK/l5EACeU55j v8x4lsNW9hL3jaLfwcByWfxGM8pgACnJhfjjEYIoAWx5uRx88rZOI4veFQ168Gyd pDE12RQmz6Vk1M6tHQyQRgwNJ4Nce09oEgIeIhLdCbBQTe4SjpeSIHla6YmFjMJd plD0R8K1rcd37DYzuGU5kf/hIDWNBoHvdtS/ccpZnSj62munQ9ArMjCw7md4PEWr o8V5p+TVnzFiBPDKs+vgBXcQ1OIZDUNnOTwiKaoXEB6CSaGGuHroQlkglqo9TUEv 9dBcVscc+UBinTExP+o87wK516raBsoh8TgyBGZNF4aKE32fuSd7Kuch+xNzT0RO weAFObPF2PvFrWzpseSP8kLqb2B/fAOGeRwfhDl8qtRoeO2UR3MuslRG6Btgh3gr kBdRPt9elLpPiUuFmXi5yEmnqPAWWY2K4cKYYGJxlp9H/5mxQw2zgO31nEvFyWbn dW1NBjE2gB1nIrHbnAponSIOQMu+W5IqVezCapOCpogMP0x2209gbBdGKzPmb3OL NuEdBnV0Ua4mTZKCxoqkJ3yfYYjURE+Le9kLRYVRJQt9T1WAB1iBCUfQuN3+ym3N I7UPscAUpEyIMvKf1fIwbvxJGu5NxDEbtkoxRpLa3CyEWD9fpFjaQLfxT+DN4CEk tfCESJQ3YLf+gztUG38QPLdxIz3i3DUfGXHmnA== =sl0g -----END PGP PUBLIC KEY BLOCK-----
Anyone can copy this website. A convincing clone on a lookalike domain costs an afternoon, and a customer looking at one has no way to tell it from us — the pixels are identical.
A signature is the difference. We hold a private key that was generated offline and has never been on our server; the public half is on this page. When something matters — a change of domain, an announcement, a decision on a disputed order — we sign it, and it verifies against this key and no other.
A clone can copy every byte of the site. It cannot produce a signature that checks out here.
The fingerprint is the short identity of a key. Two keys never share one.
F288 5293 2BFC 8BFF CCAF
EFFE 954C 7306 CDA2 122B
Before trusting a key you downloaded, check that its fingerprint matches the line above character for character. A key with the right name and the wrong fingerprint belongs to somebody else.
Compare this page against the same page on our mirror and our Tor address, both listed on the contacts page. Three routes agreeing is harder to fake than one.
You need GnuPG: brew install gnupg on macOS, apt install gnupg on Debian or Ubuntu, Gpg4win on Windows.
Import the key once:
curl -s https://vacuum.exchange/keys/vacuum-public.asc | gpg --import
Then save the signed message to a file and run:
gpg --verify message.txt
You want a line reading Good signature from "Vacuum Exchange". A warning that the key is not certified is normal — it only means you have not personally vouched for it. A BAD signature, or none at all, means the message did not come from us or was altered after signing.
Optional, and unnecessary for an ordinary exchange. If you would rather your message were unreadable in transit, encrypt it to this key:
gpg --encrypt --armor -r [email protected] message.txt
Send us the resulting block through any channel on the contacts page. Include your own public key if you want a reply encrypted back to you.
Announcements worth faking: a change or addition of domain, notice that an address has been retired, a security notice, or our position on a disputed order when a customer asks for it in writing.
What we do not sign: routine status emails, ordinary support replies, and the deposit address of an individual order. Deposit addresses come from the order page and nowhere else, which is a stronger rule than any signature.
This list does not change, and no signed message will ever contradict it. If any of it happens, you are not talking to us:
We never message you first, on any platform. We never ask for a private key, a seed phrase or a wallet password. We never give you a deposit address outside the order page. We never ask for an extra payment to release an order. We never ask for your Vacuum account password.
The same list, in full, is on the contacts page.
This key expires on 12 August 2028. Before then we either extend it or publish a replacement, and the replacement is announced in a message signed with the current key — which is how you will know it is ours.
If the key were ever compromised we would publish a revocation certificate here. GnuPG reports a revoked key as revoked the moment you refresh it, so a stolen key cannot be quietly used against you.