Official Android tools
| Task | Command | Result |
|---|---|---|
| Verify signature | apksigner verify --verbose app.apk | Checks whether the signature verifies |
| Print certificates | apksigner verify --print-certs app.apk | Shows signer certificate fingerprints |
| List permissions | apkanalyzer manifest permissions app.apk | Shows declared permissions |
| Inspect manifest | apkanalyzer manifest print app.apk | Shows package and compatibility metadata |
How to use a SHA-256 checksum
Calculate the file’s SHA-256 hash, then compare it character-for-character with a value published by the confirmed developer through a separate trusted channel. Matching an untrusted mirror’s own hash proves only that you downloaded the mirror’s file.
A simple install decision
- Source identity confirmed
- Signer matches a trusted release
- Hash matches a publisher reference when available
- Permissions fit the feature
- No security warning is being bypassed
- Update path is clear
Frequently asked questions
Can I check an APK without installing it?
Yes. Android SDK tools can inspect signature, manifest and permissions before installation.
Is SHA-256 a virus scan?
No. It identifies an exact file; safety depends on whether the reference file is trusted.
Sources and verification notes
- Android Developersapksigner: verify an APK signatureAccessed 26 August 2026 ↗
- Android Developersapkanalyzer: inspect an APKAccessed 26 August 2026 ↗
- Android DevelopersApp manifest overviewAccessed 26 August 2026 ↗
- Android DevelopersSign your app and verify certificate fingerprintsAccessed 26 August 2026 ↗
- Android DevelopersVersion your app: versionCode and versionNameAccessed 26 August 2026 ↗
ET
WRITTEN & REVIEWED BY
Editorial Team
Independent editors applying our documented source, app-identity and regulatory review method. No fictional qualifications or operator affiliation.