When a developer or a trusted archive publishes an APK, they often publish a string of letters and numbers next to it — the file’s hash. Checking that hash before you install takes less than a minute, and it is one of the strongest proofs you can get that the file on your phone is exactly the file the developer released, with nothing added, removed, or altered on the way.
This guide explains what a hash is, what a matching hash does and does not prove, and how to check an APK’s SHA-256 hash on Android and on a PC.
What Is a File Hash?
A hash is the output of a mathematical function that converts a file — any file, of any size — into a fixed-length fingerprint. For SHA-256, that fingerprint is always 64 characters long, made of the digits 0–9 and letters a–f. Two properties make hashes useful for safety checks:
- The same file always produces the same hash. Hash the same APK on two different devices and you get the identical string.
- Change one byte and the hash changes completely. There is no such thing as a “nearly matching” hash — a file altered by even a single character produces a totally different fingerprint.
You will see three hash types mentioned with APKs. MD5 (32 characters) is the oldest and is now considered weak because researchers have demonstrated ways to craft two different files with the same MD5 hash. SHA-1 (40 characters) has similar known weaknesses. SHA-256 has no practical collision attacks and is the standard you should prefer whenever a developer publishes one.
What a Matching Hash Proves — and What It Doesn’t
If the SHA-256 hash you compute matches the hash the developer published, the file is bit-for-bit identical to the file the developer hashed. Nothing was modified during upload, hosting, or download.
What it does not prove is that the publisher is honest. A matching hash on a malicious file simply confirms you received the malicious file intact. That is why hash checking works best as one layer of a routine: combine it with a signature check (see our guide on how to verify an APK signature, which confirms who signed the file) and a malware scan (see how to scan APK files for viruses free). Hash = integrity, signature = identity, scan = behavior. Together they cover the main checks in our wider guide on whether APK files are safe.
How to Check an APK Hash on Android
Android does not show file hashes in the standard system settings, so you need an app that can compute them. Many file managers include a checksum feature, and several small, free hash-checker apps on the Play Store do nothing else. The general process is the same everywhere:
- Open your file manager or hash-checker app and locate the downloaded APK.
- Select the file and look for a “Hash,” “Checksum,” or “File properties” option.
- Choose SHA-256 and let the app compute the value (large files may take a few seconds).
- Compare the result with the hash published by your source, character by character.
Tip: instead of eyeballing 64 characters, copy the published hash into the checker app if it offers a “compare” field, or paste both strings into a notes app and line them up.
How to Check an APK Hash on a PC
If you download APKs to a computer first — for example, to transfer to a phone without a data connection — every major desktop system can hash a file with built-in tools.
Windows (PowerShell)
Open PowerShell in the folder containing the file and run:
Get-FileHash .\app.apk -Algorithm SHA256
The older built-in utility works too: certutil -hashfile app.apk SHA256 (certutil prints the hash with spaces between character pairs — remove them before comparing).
macOS (Terminal)
shasum -a 256 app.apk
Linux (Terminal)
sha256sum app.apk
How to Compare Hashes Correctly
- Compare the entire string. Matching the first and last few characters is not enough.
- Case does not matter. A–F and a–f are equivalent; some tools print uppercase, others lowercase.
- Ignore spaces, nothing else. Tools like certutil insert spaces for readability. Any other difference — one digit, one letter — means a different file.
- A partial match is a non-match. If even one character differs, do not install the file. Re-download it from the original source and check again.
Where Do You Find the “Official” Hash?
The trustworthy place to get a hash is the same place the developer publishes the software: their official website’s download page, or the release notes on their project page (many open-source Android apps publish SHA-256 checksums with every release on GitHub). Well-run APK archives also list a hash on each version’s page. The important rule: get the hash from the developer’s channel, not from the same third-party page that handed you the file — a tampered download page could simply publish the hash of the tampered file.
What If the Hash Doesn’t Match?
Delete the file. A mismatch means one of three things: the download was corrupted, the file was repackaged or modified by an intermediary, or you are comparing against the hash of a different version. None of those is a file you want to install. Re-download once from the original source; if the mismatch persists, contact the developer or choose a different source and report what you found.
FAQ
Is MD5 good enough for checking an APK?
An MD5 match will catch accidental corruption and casual tampering, but because MD5 collisions can be deliberately crafted, prefer SHA-256 whenever the developer publishes one — and always pair any hash check with a signature check.
Does a matching hash guarantee an APK is safe?
No. It guarantees the file is unchanged from what the publisher released. Safety also depends on who the publisher is, whether the signature belongs to the real developer, and what a malware scan finds.
The source only lists a SHA-1 hash. Can I use it?
Yes, as a basic integrity check — it is still far better than nothing. Compute the file’s SHA-1 with the same tools above (swap SHA256 for SHA1) and compare, then rely on the signature check as your stronger verification layer.
Key Takeaways
- A hash is a file’s fingerprint: identical file, identical hash; one byte changed, completely different hash.
- Prefer SHA-256; treat MD5 and SHA-1 as basic checks only.
- Get the reference hash from the developer’s own channel, never from the download page itself.
- Combine hash + signature + virus scan before installing any sideloaded APK.