How to Verify an APK Before Installing It, Step by Step
This is the practical sequence for verifying an APK file, in the order that actually catches problems fastest. Each step catches something the previous one cannot, which is why skipping any single one leaves a gap.
Step 1: Match the Basics Before Opening a Terminal
Compare the file size and version number against the listing you downloaded from. A mismatch here is the cheapest possible catch, and it needs no tools at all.
Step 2: Checksum, Then Signature
Run shasum -a 256 filename.apk on macOS or Linux, or certutil -hashfile filename.apk SHA256 on Windows, and compare the result against the published hash. Then run apksigner verify --print-certs filename.apk and record the certificate digest.
Do both, in this order. The checksum is faster and catches simple corruption or a swapped file immediately. The signature check catches the harder case: a file that passes the checksum because the hash was computed after tampering.
Step 3: Scan, Then Review Permissions on First Launch
Let Play Protect scan the file before opening it, then review the permission list Android shows on first launch rather than dismissing it. A permission unconnected to any visible feature is the last and most reliable check in the sequence.
Frequently Asked Questions
What tool do I need to check an APK's SHA-256 hash?+
No special tool is required. macOS and Linux include shasum natively (shasum -a 256 filename.apk), and Windows includes certutil (certutil -hashfile filename.apk SHA256). Both produce equivalent output you can compare against a published hash.
How do I check who signed an APK?+
Use apksigner, included with the Android SDK build-tools, and run apksigner verify --print-certs filename.apk. It prints the SHA-256 digest of the signing certificate, which you compare against a previously installed version of the same app or a value published by the developer.
Can I verify an APK without a computer?+
Checksum apps exist on Google Play for on-device hashing, though signature verification tools are less common on mobile. For a full check, transferring the file to a desktop briefly is the more reliable path.
What if the checksum matches but I have no reference signature to compare against?+
Record the signer digest anyway, even without a comparison value. It becomes the reference for every future update of that same app, which is when signature checking actually pays off: catching a changed signer on an update you did not expect to change.