How to Tell a Genuine Android App From a Fake: APK Signatures and SHA-256 Checksums, Explained

ByAbaidullah Shahid

Most Android users never think about where an app comes from. They tap Install in Google Play and move on. But plenty of legitimate apps are also handed out as APK files from a company’s own website: beta builds, apps for markets where a store listing isn’t available, corporate tools, and services that Google Play doesn’t carry. Fake copies of popular apps travel the same way. Luckily, two checks built into how Android works make the difference visible: the developer’s signature on the APK, and a checksum of the download. You need no special skill for either.

What an APK signature actually proves

Android refuses to install an unsigned app; each one carries its developer’s digital signature[2]. To produce it, the developer generates a private key, guards it, and signs every release with it. No central authority stands behind these certificates. Android accepts self-signed ones and never checks them with a certificate authority[2]. A signature therefore says nothing about whether a company is honest. It proves continuity instead: whoever signed today’s version also signed the previous one.

That continuity is your protection. Before applying an update, Android compares the certificate of the incoming version with the certificate of the installed app, and it goes ahead only when the two match[1]. Google’s own guide tells developers to keep the same certificate for the whole life of an app, and warns that a developer who loses the key can no longer ship updates to existing users[1]. In practice this means that once you have a genuine copy installed, a fake “update” signed by someone else cannot quietly replace it. Android will refuse it.

The weak moment is the first install. If the very first file you install is a fake, the signature check will happily protect the fake from then on. That is why the first download deserves a little care.

What SHA-256 checksums are

A checksum is a short fingerprint of a piece of data. SHA-256 is one of the hash functions defined in the US government’s Secure Hash Standard, FIPS 180-4[4]. The standard describes hash digests as a way “to detect whether messages have been changed since the digests were generated”[4]. Hash one APK twice and both results are the identical 64-character string. Alter one byte and the new string bears no resemblance to the old one.

Some publishers print the SHA-256 value beside their download button. When the hash you compute matches theirs, your copy is byte for byte what they uploaded, untouched in transit. For example, the download page for the JoyCasino Android app lists the SHA-256 checksum of its APK, so users can compare it before installing[12]. Many open-source projects publish checksums in the same way.

How to check a checksum in a minute

The easiest place to do this is a computer. Download the APK there, then run one command:

  • Windows. Open PowerShell and type Get-FileHash followed by the path to the APK. It uses SHA-256 by default[5].
  • macOS. Open Terminal and type shasum -a 256 followed by the file name.
  • Linux. Use sha256sum with the file name. The same tool can also check a file against a saved list of checksums[6].

Compare the result with the published value character by character, or at least the first and last eight characters. Upper or lower case does not matter. If even one character is different, do not install it.

On the phone itself, some file managers can show a hash too, but a computer is the more reliable place for it.

Going one step further: check the signature yourself

A checksum only confirms that your copy equals the one offered on that page. Should someone break into the page, they could replace the APK and the printed value together. Forging a signature is much harder, since that requires the developer’s private key.

Command-line users can run this check with apksigner, a free utility shipped in Google’s Android SDK Build Tools. Typing apksigner verify app.apk reports whether Android will accept the signature across the system versions the app targets. With –print-certs added, it also prints details about the signing certificate[3]. Where a developer publishes its certificate fingerprint, compare that value just as you would a checksum. Unlike the hash of a single download, the certificate fingerprint does not change from one release to the next.

Protection built into Android

The system also helps. Android 8.0 removed the old global setting that let any app install anything. Now each installer, your browser for example, needs its own permission, which you can withdraw in Settings whenever you like[7].

Google Play Protect is on by default. It also checks apps that come from outside Google Play, warns about harmful ones and can switch them off or remove them[8]. From late 2023, beginning in India, it can also suggest a live, code-level scan when you try to install an app unknown to Google[9].

Developer verification is the most recent addition. Its rollout started on 30 September 2026 for certified phones and tablets in four countries: Brazil, Indonesia, Singapore and Thailand. On those devices an app installs only if its developer has confirmed their identity with Google, and that applies to apps downloaded from websites too[10]. Google plans to expand this worldwide in 2027 and says users can still install unregistered apps through an “advanced flow” for experienced users or through ADB[11].

Browsers add their own caution too. Chrome shows a warning when you download any APK file. That warning appears for every APK, genuine or not, so on its own it tells you nothing about a particular file.

A short checklist before you install an APK

  1. Download from the developer’s own website, opened by you, rather than from a link in an ad, a chat or a comment.
  2. Look at the address bar: HTTPS, and exactly the domain you expected.
  3. When a SHA-256 value is shown, compute your own and compare the two.
  4. Allow “install unknown apps” only for the installer you need at that moment, then switch it off again.
  5. Keep Play Protect switched on and read its warnings instead of clicking past them.
  6. Look at the permissions the app asks for. A simple app that wants your SMS messages and contacts is a red flag.
  7. Update through the app or the same official page. Android’s signature check will then make sure each update comes from the same developer.

None of this takes long. A one-minute checksum check and a habit of downloading only from the source keep you out of reach of most fake APKs.

Sources

  1. Android Developers. “Sign your app.” developer.android.com/studio/publish/app-signing
  2. Android Open Source Project. “Application signing.” source.android.com/security/apksigning
  3. Android Developers. “apksigner.” developer.android.com/tools/apksigner
  4. NIST. FIPS 180-4, “Secure Hash Standard (SHS),” August 2015. csrc.nist.gov/pubs/fips/180-4/upd1/final
  5. Microsoft Learn. “Get-FileHash.” learn.microsoft.com/powershell/module/microsoft.powershell.utility/get-filehash
  6. Linux manual page. “sha256sum(1).” man7.org/linux/man-pages/man1/sha256sum.1.html
  7. Android Developers Blog. “Making it safer to get apps on Android O,” 22 August 2017. android-developers.googleblog.com/2017/08/making-it-safer-to-get-apps-on-android-o.html
  8. Google Play Help. “Use Google Play Protect to help keep your apps safe and your data private.” support.google.com/googleplay/answer/2812853
  9. Help Net Security. “Google Play Protect takes on malicious apps with code-level scanning,” 19 October 2023. helpnetsecurity.com/2023/10/19/scanning-sideloaded-android-apps
  10. Android Developers. “Android developer verification.” developer.android.com/developer-verification
  11. Android Developers Blog. “Android developer verification: Rolling out to all developers on Play Console and Android Developer Console,” 30 March 2026. android-developers.googleblog.com/2026/03/android-developer-verification-rolling-out-to-all-developers.html
  12. JoyCasino. Android app download page with the APK’s SHA-256 checksum. joycasino.name/android-app/