monero-wallet-cli without your own node

Short, practical notes from setting up monero-wallet-cli on a fresh Linux box without running a full node. Nothing fancy, just the steps people tend to skip.

1. Download from the official source, then check the hash

Get the CLI bundle from getmonero.org/downloads. Next to it is hashes.txt (https://www.getmonero.org/downloads/hashes.txt), which is GPG-signed by binaryFate.

sha256sum monero-linux-x64-v0.18.*.tar.bz2
grep linux-x64 hashes.txt

The two values have to match exactly. A hash match only proves the file matches the hash list, so if you can, also verify the list itself:

gpg --import binaryfate.asc        # key from the monero repo: utils/gpg_keys/binaryfate.asc
gpg --verify hashes.txt

Look for "Good signature" from binaryFate and compare the key fingerprint with the one published on getmonero.org. A hash taken from the same server as the binary, with no signature check, is the weak link. Privacy note: a remote node also sees your IP and which blocks you scan, so if you skip running your own node, connect over Tor (see section 3).

2. Create the wallet offline if you can

You don't need a network connection to create a wallet:

./monero-wallet-cli --generate-new-wallet ~/wallets/main --offline

Write the 25-word seed down and keep it off screenshots, cloud notes and chat apps. Also write down the restore height (the current block height when the wallet was created). If you ever restore from the seed, giving the restore height saves you from scanning from 2014.

3. Connecting to a remote node

Without your own node you connect to someone else's:

./monero-wallet-cli --wallet-file ~/wallets/main --daemon-address node.example:18081 --untrusted-daemon

Things worth knowing:

• A remote node can't steal your funds or see your keys. It can see your IP and roughly when you're online. It can also try to feed you bad decoys, which lowers your privacy in a small way. Over Tor (--proxy 127.0.0.1:9050) the IP part goes away.
• Keep --untrusted-daemon on for nodes you don't run. --trusted-daemon is for your own node only.
• If the node's height looks wrong (status / bc_height), switch nodes. Compare against a couple of block explorers.
• Running your own node, even a pruned one (monerod --prune-blockchain, roughly 95 GB), is still the best choice if you have the disk.

4. Handy commands once you're inside

• address shows your primary address. address new label makes a fresh subaddress for each payer, so two payers can't link their payments to each other.
• balance / show_transfers show what you've got.
• set refresh-from-block-height N fixes slow first syncs.
• viewkey prints the private view key. Treat it as sensitive: it can't spend, but it reveals every incoming payment. Only give it to a service you actually trust, ideally for a wallet used only for that service.
• exit saves the wallet. Don't just kill the terminal.

5. View-only wallet for a watch-only machine

On the main machine, get the address and the view key, then on the other machine:

./monero-wallet-cli --generate-from-view-key ~/wallets/watch

It shows incoming transfers but can't spend. Note that it can't see outgoing spends accurately unless you import key images.

---

If anything here is wrong or outdated, please correct me. I'd rather fix the post than have someone copy a mistake.

Tips welcome via zap if this helped.