How to Verify an APK: Checksum and Signature Check in 2026

You found the APK you need on a third-party site. It has the right name, the right icon, the right version number. But anyone can open an APK, change the code, and re-upload it under the same name. Version numbers and icons prove nothing.

The only way to know the file on your disk is the real app is to verify it yourself: compare its SHA-256 checksum against the official source, and inspect its signing certificate. Both take under a minute once you know the commands.

The core rule: a matching checksum proves the file wasn't tampered with; a valid signature proves who built it. You want both.

1. Why checksums and signatures matter

An APK is just a ZIP archive. Anyone with the file can:

• Decompile it, inject adware or a backdoor, and recompile.
• Re-sign it with their own key so Android will still install it.
• Keep the same name, icon, and version string.

Two defenses catch this:

• Checksum (SHA-256): a fingerprint of the exact bytes. If even one byte changed, the hash is completely different.
• Signature:Android requires every APK to be cryptographically signed. The signer's certificate is embedded and can't be faked without the private key.

Verify the checksum → the file is intact. Verify the signature → it came from the right developer.

2. Get the official checksum first

A checksum only helps if you compare against a trusted reference. Get it from:

• The developer's official site (many publish SHA-256 next to the download).
• The app's official GitHub Releases page.
• APKMirror / APKPure, which show the checksum on the file page.

If the site gives you no checksum at all, treat that as a yellow flag— you'll have to lean entirely on the signature check.

3. Compute the SHA-256 on your computer

Download the APK, then run the right command.

Windows (CMD):

certutil -hashfile app.apk SHA256

Windows (PowerShell native):

Get-FileHash .\app.apk -Algorithm SHA256

macOS:

shasum -a 256 app.apk

Linux:

sha256sum app.apk

Compare the output to the official value, character by character. Case doesn't matter; every character does. A single mismatch means the file is not the one the publisher released — delete it.

Tip: if the checksum is truncated or formatted with spaces/dashes on the website, strip those before comparing.

4. Verify the signature

The checksum ties you to a specific file; the signature ties that file to a developer. Use Android's own tools.

With apksigner (Android SDK build-tools):

apksigner verify --print-certs app.apk

This prints the signer's certificate: the DN (distinguished name) and SHA-256 fingerprintof the signing cert. Compare the fingerprint against the one shown on the app's official page or Play Store listing.

With keytool (bundled with the JDK):

keytool -printcert -jarfile app.apk

This also outputs the certificate fingerprint. The SHA-256 fingerprint must matchthe official app's.

Why this matters: if a repackager modified the APK, they had to strip the original signature and re-sign with theirkey. The fingerprint will differ — that's your tell.

5. Verify on the phone itself

No computer handy? There are apps for it:

• Signature checkers show the signing certificate fingerprint of an APK.
• App Inspectortools list the installed package's signature.
• Some file managers compute SHA-256 directly from a downloaded file.

Compare the fingerprint shown against the official one. A different signing fingerprint than the official app = a repackaged build.

Note: Android blocks installing an APK whose signature doesn't match the already-installed version of the same package. If you get a "signature mismatch" error when updating, that's this exact mechanism — often a sign the new file is from a different signer.

6. Red flags of a repackaged APK

Even before you run commands, watch for:

• File size noticeably larger than the official build.
• Different developer name in the package info (aapt dump badging app.apk shows it).
• Same icon/name as a popular app, unknown publisher.
• Requests permissions far beyond its function (a calculator asking for SMS).
• No checksum published anywhere reliable.
• HTTP (not HTTPS) download link.

Any one of these plus a mismatched hash or cert = throw it away.

7. A 60-second verification recipe

1. Download the APK from a trusted source.
2. Grab the official SHA-256 from the developer.
3. Run sha256sum / shasum / certutil and compare.
4. Run apksigner verify --print-certs and compare the cert fingerprint.
5. Both match → install with confidence. Either mismatches → delete and re-download elsewhere.

8. FAQ

Q: The checksum matches but the signature looks different.Trust the signature — it's cryptographic identity. A cert mismatch means re-signing; don't install.

Q: The site gives no checksum. Fall back to the signature check and reputation of the source. Prefer sources that publish hashes.

Q: Can a checksum be faked? Only by serving you a re-signed file anda fake checksum together — which a malicious page can do. That's why you compare against a source you already trust, and check the signature too.

Q: Does Play Protect do this for me?Partially, for Play-installed and scanned apps. It won't verify a manual sideload against the publisher's published hash.

Bottom line: a downloaded APK is just bytes until you verify it. Checksum = is this the exact file? Signature = did the right developer build it?Check both in under a minute with the commands above, and you'll never install a repackaged build by mistake. For the wider workflow, see our guide on checking whether an APK is safe.