How to Check an APK’s SHA-256 Checksum

Quick answer: A SHA-256 checksum is a long fingerprint calculated from a file. If a publisher lists the SHA-256 of its APK, you can calculate the fingerprint of your downloaded file and compare. If the two match exactly, your file is identical to the one the publisher listed. If even one character differs, delete the file.

On Windows

1. Open PowerShell in the folder with the APK.
2. Run: Get-FileHash .app.apk -Algorithm SHA256
3. Compare the result with the publisher’s value.

On Mac or Linux

1. Open Terminal in the download folder.
2. Run: shasum -a 256 app.apk (Mac) or sha256sum app.apk (Linux).
3. Compare.

On Android

Use a reputable hash-checking app from the Play Store, select the APK and choose SHA-256. Then compare with the published value.

What a match proves

A match proves	A match does not prove
The file is identical to the publisher’s listed file	The publisher is trustworthy
It was not altered in transit	The app is legal or safe to use
	The listed hash itself came from the genuine publisher

That last point matters: if the page listing the hash is itself fake, a matching hash is meaningless. Get the hash from a source you trust, ideally the same official page you would trust for the download.

Signatures vs checksums

Android also checks an app’s signing certificate on updates. A checksum verifies a single file; a signature verifies who built it. See our APK file guide.

Frequently asked questions

Is MD5 good enough?

Prefer SHA-256. Older algorithms like MD5 are weaker.

What if the publisher gives no hash?

Rely on other checks: source, version, signature and permissions.

Can a hash check find malware?

No. It only tells you whether two files are identical.