How to Check an APK’s SHA-256 Fingerprint, Step by Step

Every platform reviewed on this site publishes a SHA-256 fingerprint alongside its APK, but a fingerprint is only useful if you actually check it. This is the practical, step-by-step version of that check.

What a fingerprint actually proves

A SHA-256 hash is a fixed-length string generated from a file’s exact contents. Change even one byte of the file, and the resulting hash is completely different. If the hash of your downloaded file matches the hash published by the source, you have strong evidence the file was not modified in transit or swapped for something else along the way. It does not prove the app is safe, legitimate, or trustworthy — only that the file matches what the publisher says it should be.

How to check it on Android

• Install a file-hash checking app from the Play Store (search “SHA-256 checksum” or “hash checker”), or use a checksum feature built into a file manager app you already trust.
• Point it at the downloaded APK file, not the installed app — the check has to happen before installation to be meaningful.
• Compare the resulting string character-by-character against the fingerprint published on the source page. Even one different character means the files don’t match.

How to check it on a computer

• Windows: open Command Prompt and run certutil -hashfile filename.apk SHA256.
• Mac/Linux: open a terminal and run shasum -a 256 filename.apk.
• Compare the output against the published fingerprint the same way.

If the fingerprints don’t match

Do not install the file. A mismatch means the file you have is not the one the source actually published — whether from a corrupted download, a compromised mirror, or something worse. Re-download from the original source and check again before assuming it’s a fluke.

This single check takes under a minute and catches a specific, real category of problem that eyeballing a file’s size or icon cannot. Pair it with the rest of our APK safety checklist for the fuller picture.