How to Verify an APK Before Installing It, Step by Step
This is the practical sequence for verifying an APK file, in the order that actually catches problems fastest. Each step catches something the previous one cannot, which is why skipping any single one leaves a gap.
Step 1: Match the Basics Before Opening a Terminal
Compare the file size and version number against the listing you downloaded from. A mismatch here is the cheapest possible catch, and it needs no tools at all.
Step 2: Checksum, Then Signature
Run shasum -a 256 filename.apk on macOS or Linux, or certutil -hashfile filename.apk SHA256 on Windows, and compare the result against the published hash. Then run apksigner verify --print-certs filename.apk and record the certificate digest.
Do both, in this order. The checksum is faster and catches simple corruption or a swapped file immediately. The signature check catches the harder case: a file that passes the checksum because the hash was computed after tampering.
Step 3: Scan, Then Review Permissions on First Launch
Let Play Protect scan the file before opening it, then review the permission list Android shows on first launch rather than dismissing it. A permission unconnected to any visible feature is the last and most reliable check in the sequence.
First launch is the only moment the full declared set is visible before anything has been granted. Once device administrator or accessibility service is approved, the capability is live and revoking it later does not undo whatever it already did — so the review belongs before the grant, not after the first suspicious behaviour.
Recording the Result So the Next Update Is Faster
Verification is not a one-time task. An app you confirmed six months ago may have shipped a new build since, and the old file's hash says nothing about the new one. Keeping the four values you checked — package name, version code, file size, and SHA-256 — makes the next update a comparison instead of a fresh investigation, and it is the only way to notice that a file has changed since you last approved it.
This matters specifically for sideloaded apps, because there is no store-managed update path performing that comparison for you. A store-delivered update is checked and applied by the platform; a sideloaded one arrives as a new file from a source you chose to revisit, and whether it is still the same app is entirely your question to answer. The recorded values are what make it answerable.
The habit is small. Note the four values when you verify, then compare them before installing any update. A matching package name with a changed hash is the ordinary case for a legitimate release. The same combination where the signing certificate also changed is the case that warrants stopping and re-reading the source you fetched it from.
Cross-check Against the ComeAPK Manifest
Verification values that have no anchor are verification values that cannot be trusted. The SHA-256, file size, package name, and version code you compare against must come from /en/come-app/#platform-manifest or /en/dream11-app/#site-downloads; any third-party listing that disagrees with the manifest on a single one of these is a stop signal, not an alternative source.
Every field referenced in "How to Verify an APK Before Installing It, Step by Step" — package name, version, file size, and SHA-256 — is cross-checked against the ComeAPK release manifest. That comparison is the last step, not the first: a field that disagrees is treated as tampering evidence per /en/blog/sha-256-apk-integrity/, and the install stops there until the manifest copy is on the device.
Frequently Asked Questions
What tool do I need to check an APK's SHA-256 hash?+
No special tool is required. macOS and Linux include shasum natively (shasum -a 256 filename.apk), and Windows includes certutil (certutil -hashfile filename.apk SHA256). Both produce equivalent output you can compare against a published hash.
How do I check who signed an APK?+
Use apksigner, included with the Android SDK build-tools, and run apksigner verify --print-certs filename.apk. It prints the SHA-256 digest of the signing certificate, which you compare against a previously installed version of the same app or a value published by the developer.
Can I verify an APK without a computer?+
Checksum apps exist on Google Play for on-device hashing, though signature verification tools are less common on mobile. For a full check, transferring the file to a desktop briefly is the more reliable path.
What if the checksum matches but I have no reference signature to compare against?+
Record the signer digest anyway, even without a comparison value. It becomes the reference for every future update of that same app, which is when signature checking actually pays off: catching a changed signer on an update you did not expect to change.