How to Check APK File Integrity: 3 Ways to Confirm a Download Wasn't Tampered With (2026)
Same filename, same icon, same version number — that doesn't mean the APK is clean. Learn three practical ways to verify an APK's integrity and signature before you install it: hash comparison, signature fingerprints (apksigner/SAI), and VirusTotal.
Same filename, same icon, same version number — that proves nothing. When you download an APK from a third-party site, the real question is whether the file matches the official build, or whether someone repackaged it and slipped something in. The good news: every APK carries verifiable “fingerprints,” and three simple methods tell you if it’s been tampered with.
Bottom line: Hash values (SHA-256) prove the file didn’t change. Signature checks prove it came from the official developer. Together, they lock down an APK’s authenticity.
Core idea: A hash alone isn’t enough — a malicious site hands you a fake hash too. Compare against the official value, and rely on signature fingerprints for the strongest check.
What “integrity” actually means
People conflate two different things. Split them apart and it gets much clearer:
- File integrity — whether the file was corrupted or swapped in transit. → verify with a hash (SHA-256/MD5).
- Source authenticity — whether the package was signed by the real developer and not repackaged. → verify with the digital signature (certificate fingerprint).
A hash alone can’t protect you: if the source is malicious, the hash it publishes is fake too. That’s why signature fingerprints — compared against the known official fingerprint — are more trustworthy.
Method 1: Hash verification (fastest, for official releases)
If the developer or a trusted site publishes a SHA-256, compute the local file’s hash and compare.
# Windows (PowerShell)
Get-FileHash .\app.apk -Algorithm SHA256
# macOS / Linux
shasum -a 256 app.apk
sha256sum app.apkCompare the output against the official 64-character hex string, character by character. One character off means the file is corrupted or modified.
Method 2: Signature fingerprint (most reliable, defeats repackaging)
A hash proves the file didn’t change, but what if you don’t have an official hash? Use the signing certificate fingerprint— it derives from the developer’s private key, so anyone who repackages the app must re-sign it and the fingerprint changes.
apksigner verify --print-certs app.apkYou’ll see a line like Signer #1 certificate SHA-256 digest: 8a3f... (64 hex chars). Compare that against the official build of the same app (e.g., one extracted from Google Play). Match → same developer. Mismatch → it was almost certainly repackaged.
No computer? Use an app.SAI (Split APKs Installer) or APK Info shows the signing certificate’s SHA-256 fingerprint right on your phone.
Method 3: Cross-check with VirusTotal (against malware)
Integrity checks catch “file changed,” but not “the official build itself is dirty” (rare but real). Use multi-engine scanning as a cross-check:
- Open VirusTotal and upload the APK — or better, paste its SHA-256 (faster and more private).
- Review 60+ engines: all green is ideal; multiple mainstream engines flagging it is a red flag.
- Combine with the signature check: fingerprint matches + no malware = safe to install.
Pick the right method
| Your goal | Method | Tool |
|---|---|---|
| Confirm download isn’t corrupted | Hash compare | sha256sum / PowerShell |
| Confirm it’s official, not repackaged | Signature fingerprint | apksigner / SAI |
| Confirm there’s no malware | Multi-engine scan | VirusTotal |
| Full coverage | All three | Combined |
Why “same version number” can still differ
The same app at the same version can carry different signatures depending on the source: the official build uses the official key; if a third-party site modified anything (removed ads, changed language, injected a channel ID), it mustre-sign — and the fingerprint changes instantly. That’s why you can hit “App not installed” even with matching version numbers, and why signature checks beat version numbers every time.
60-second pre-install checklist
- Grab the official SHA-256 from the download page (if available).
- Compute the local hash and compare, character by character.
- Check the signature SHA-256 with apksigner or SAI, compare to official.
- Paste the SHA-256 into VirusTotal.
- All pass → install; any mismatch → get it from another source.
Do this and you can be accountable for every APK you install. Integrity and signatures are the two strongest defenses a regular user has.
Want a shortcut? gptoapk.com extracts original APKs straight from Google Play with verification info attached, saving you the hunt for official hashes.