Check the bytes locally
This tool reads the selected file on your device and calculates SHA-256 using the browser’s Web Crypto API. It sends zero file bytes to this site. A 200 MiB limit controls browser memory use; it is a tool limit, not an app requirement.
The file stays in your browser. Maximum tool size: 200 MiB.
Eight fields make a useful release record
| Field | Expected format | How it helps |
|---|---|---|
| Package ID | Exact text from the manifest | Distinguishes similarly named apps |
| versionName | Publisher’s display string | Identifies the named release |
| versionCode | Integer from the manifest | Distinguishes update builds |
| minSdkVersion | Android API integer | Checks OS compatibility |
| ABIs | Exact native architecture list | Checks native device compatibility |
| File size | Exact byte count | Flags incomplete or different files |
| SHA-256 | 64 hexadecimal characters | Identifies the exact file bytes |
| Signing identity | Certificate SHA-256 and signing history | Checks publisher continuity |
For a technical inspection
Android SDK Build Tools can check signing data with the following command. Successful signature verification establishes signature validity, not the trustworthiness of the publisher.
apksigner verify --verbose --print-certs app.apkOn a computer, a standard SHA-256 file utility can calculate the digest. Compare it with a release record obtained independently from the publisher. A digest copied from the same unknown download page adds little independent evidence.
Sources and scope
References checked on 26 October 2026. A general rules reference describes its own game or convention; it does not establish the settings of an untested APK.
Guide evidence record
| Parameter | Value |
|---|---|
| Tool file limit | 200 MiB |
| Digest format | 64 hex characters |
| File bytes uploaded by this tool | 0 |
Editorial review: . Guide parameters and source measurements are separate from APK release specifications.