How to verify an APK signature and SHA-256 checksum
A practical workflow for checking an Android package identity, signer, and file checksum before installation.
Why both checks matter
A SHA-256 checksum identifies the exact bytes in a downloaded file. If one byte changes, the checksum changes. It is useful for detecting an incomplete download or comparing a file with a checksum published by a source you already trust.
An Android signing certificate answers a different question: which signing key approved the package? Android uses that signer when deciding whether a new APK may update an installed app. A matching package name without a matching signer is not the same release identity.
Calculate the file checksum
On Windows, run certutil -hashfile filename.apk SHA256. On macOS or Linux, run shasum -a 256 filename.apk. Read the whole 64-character result and compare it character by character with a checksum obtained through a separate trusted channel.
A checksum shown by the same untrusted download page only proves that the file matches that page. It does not prove that the developer created the file. Treat the checksum as one part of a wider provenance check.
- Download the file completely before calculating the hash.
- Compare all 64 hexadecimal characters, not only the first or last few.
- Delete the file when the expected and calculated values differ.
Inspect the Android signer
Android build tools include apksigner. Run apksigner verify --print-certs filename.apk to check the package signature and print certificate digests. Record the SHA-256 certificate digest and compare it with a previously trusted version of the same app.
Key rotation and Play App Signing can make comparisons more complicated. When a signer changes unexpectedly, do not bypass Android update warnings. Confirm the change through the developer or an official release channel.
Make a decision
A matching checksum, a valid signature, and a familiar package name reduce risk but do not guarantee that an app behaves safely. Keep Play Protect enabled, review requested permissions, and avoid packages that ask you to disable security controls.
Storageapk records version and package metadata as reference information. Readers should independently verify any executable file before installation.