How to verify an APK's signature before installing it
Ways to confirm an APK is genuine: on the phone, on a computer (apksigner) and with VirusTotal. Includes the official Play Store fingerprint.
Every APK carries a digital signature from whoever built it. It works like a seal: if someone modifies the app to inject ads or malware, they can't re-sign it with the original developer's key. Comparing the signature with the official one is the most reliable way to know an APK is genuine.
Play Store's official signature
| SHA-256 | F0:FD:6C:5B:41:0F:25:CB:25:C3:B5:33:46:C8:97:2F:AE:30:F8:EE:74:11:DF:91:04:80:AD:6B:2D:60:DB:83 |
|---|---|
| SHA-1 | 38:91:8A:45:3D:07:19:93:54:F8:B1:9A:F0:5E:C6:56:2C:ED:57:88 |
If a file shows any other fingerprint, it isn't the official store, even if it's called "Google Play Store" and has the same icon.
Method 1: download from a repository that already checks
Repositories like APKMirror, where our button points, verify that every file has the same signature as the developer's previous versions before publishing it, and show the fingerprint on each version's page.
Method 2: on the phone
Android only accepts an APK over an installed app if the signatures match; otherwise you get App not installed. To see the fingerprint before installing, use a well-reviewed APK inspector app from Play Store.
Method 3: on a computer (most reliable)
- Install the Android SDK Build-Tools (bundled with Android Studio or the command-line tools).
- Open a terminal in the APK's folder.
- Run:
apksigner verify --print-certs file-name.apk - Compare the
Signer #1 certificate SHA-256 digestline with the official one (apksigner prints it without colons).
Method 4: VirusTotal
Upload the file to virustotal.com. The Details tab shows the certificate. The file stays stored on their service.