What you will learn
Understand signing files, hashes and what to check before trusting or distributing an APK.
APK signature verification checks the package's cryptographic signatures and integrity. Comparing a whole-file SHA-256 hash with a trusted reference is a separate check. Listing signature-related archive files does not verify a signature or establish who you should trust.
Use APK Signing File Inspector to inspect signing files and hashes locally, or open the broader APK Analyzer when you also need manifest, permission and structure details.
Why APK signatures matter
Android uses app signing to decide whether an APK is trusted as the same app during installation and updates. If a new APK is signed with a different certificate from the installed version, Android blocks the update.
A matching package name is not enough. For updates, Android also expects the signing identity to match.
Signature checks vs file hashes
| Check | What it tells you | Limitation |
|---|---|---|
| SHA-256 hash | Whether this exact file matches a known copy. | It does not explain who signed the APK. |
| META-INF files | Classic signature-related archive entries. | Modern APKs may also use newer signing schemes. |
| Package name | The app identity declared by the manifest. | It can be copied by a malicious package. |
| Version code | Whether the file is older or newer than another build. | It does not prove authenticity. |
Step 1: Inspect the APK before installing
Open the file in APK Analyzer and review the security, signing, hash and file structure sections. This can reveal package identity, signature-related files and hashes without uploading the APK.
Step 2: Compare hashes from trusted sources
If a developer or trusted distribution source publishes a SHA-256 hash, compare it with the hash calculated from your file. A mismatch means the file is different and should not be treated as the same build.
| Comparison | Match means | Mismatch means |
|---|---|---|
| SHA-256 vs trusted SHA-256 | The file is byte-for-byte the same as the trusted copy. | The file changed, was rebuilt, corrupted or is not the same release. |
| Package name vs expected package | The app declares the expected identity. | The file is for another app or declares a suspicious identity. |
| Version code vs installed version | The update direction is clear. | You may be attempting a downgrade or unrelated build. |
| Signing files vs previous package | Classic signature entries look consistent. | Android may block updates or the package may need deeper verification. |
Step 3: Watch for signature conflicts
If Android reports that an app is not installed during an update, a signature mismatch may be the reason. This often happens when mixing store builds, debug builds, modified builds or packages from different sources.
Security signals to review
| Signal | Normal expectation | Reason to pause |
|---|---|---|
| Package name and label | They match the app you expect. | The label looks familiar but the package id is unrelated. |
| Version code and version name | They make sense for the release path. | The build is unexpectedly old, unofficial or downgraded. |
| Permissions | They match the app purpose. | A simple app asks for broad SMS, contacts or accessibility access. |
| Exported components | Only required components are exposed. | Many activities, services or receivers are unexpectedly exported. |
| Hashes | They match trusted published values when available. | No trusted reference exists or values do not match. |
What APK signature verification cannot prove
Verify with Android SDK Build Tools
Install Android SDK Build Tools from the official Android tools distribution, then run the following command against the extracted APK. Replace app.apk with your filename or full path:
apksigner verify --verbose --print-certs app.apkThis is a command example, not output from a package tested for this article. On Windows, the Build Tools directory includes apksigner.bat. If the command is not on your PATH, invoke it from that directory using the APK's full path.
Check the verification result and signer certificate information. Compare the signer certificate fingerprint with a trusted developer reference when one is available. A valid signature alone does not establish that the signer is trustworthy or the app is free of malicious behavior. For split packages, check each APK you intend to install.
See the official apksigner reference for verification options and platform-version handling. The browser inspector on this site does not perform this cryptographic verification.
A signature or hash check is one part of review. It cannot guarantee that an app is safe, bug-free or privacy-friendly. It helps you confirm file identity and spot obvious tampering or mismatches.
Recommended workflow
- Inspect the APK with APK Analyzer.
- Verify signatures with Android SDK apksigner and compare signer information with a trusted reference.
- Compare file hashes if a trusted source publishes them.
- Review permissions and exported components.
- Avoid installing packages from sources you do not trust.
Responsible use note
Use these tools only with apps you own, develop, or have permission to analyze. Avoid modifying, redistributing, or installing packages from sources you do not trust.