Sources reviewed 18 October 2026. Documentation-based guide; no physical-device test is claimed.
To verify an APK checksum, calculate the downloaded file’s SHA-256 value and compare all of it with the publisher’s reference for that exact file. A match is strong evidence that the bytes match the reference. It does not independently establish who supplied the reference or whether the app behaves safely.
Documentation reviewed 18 October 2026. The commands below are documented examples; this article does not report testing an APK or certifying a download.
What you need before calculating anything
- The completed APK download, with its actual saved location.
- A publisher-provided SHA-256 reference for the exact release and variant.
- A clear distinction between the APK file’s hash and any certificate fingerprint shown beside it.
Record the version, architecture, release channel and filename associated with the reference. Do not compare a universal APK with an ARM64-only APK, or an APK with an XAPK container. Our package-format comparison explains those containers; the ARM64 versus ARM guide explains architecture labels.
Calculate the SHA-256 value on Windows
PowerShell’s Get-FileHash documentation describes calculating a file-content hash and choosing SHA256. Use the command below with the real path to your downloaded APK. This reads the file for hashing; it does not install or run the app.
Get-FileHash -LiteralPath 'C:\Downloads\example.apk' -Algorithm SHA256- Open PowerShell on the Windows computer containing your downloaded file.
- Replace the example path with that file’s actual location. Keep the path in quotes.
- Run the command and locate the Hash value in the output.
- Compare the full value with the exact publisher reference. Do not compare only its first or last few characters.
- Confirm that both values are labelled SHA-256; an SHA-1 or MD5 value is not an alternative representation of the same SHA-256 result.
A SHA-256 value written in hexadecimal has 64 characters. Uppercase and lowercase A–F represent the same hexadecimal digits. Do not remove or overlook a different digit while cleaning up copied whitespace. If the publisher provides a checksum manifest, use the entry naming your particular file.
How to interpret the result
| Result | What it supports | What to do next |
|---|---|---|
| The full SHA-256 values match | The file matches the referenced bytes with the strength of the hash comparison. | Still assess the publisher, source, permissions and compatibility. |
| The values differ | This download has not been verified against that reference. | Check the exact release, variant, file format and reference before another download. |
| There is no trusted reference | You have a file identifier, not a publisher comparison. | Ask the publisher for the exact checksum or use its supported distribution route. |
If the checksum does not match
First confirm you selected the intended file rather than an older copy with a similar name. Compare release and variant labels, then confirm that the download finished. If those details agree, obtain a fresh copy through the publisher’s official route and compare it again. Keep the mismatch unresolved until you understand it.
A mismatch does not identify the cause by itself: a wrong release, incomplete download or changed package are different possibilities. Do not describe a file as malware solely because it differs, and do not install it merely because a page says the mismatch is harmless. For download problems, use our download-failure guide.
Downloaded the APK twice? Identify the file before cleanup
A filename suffix such as “(1)” is not evidence that one copy is newer, genuine or safer. Compare the actual saved files and the publisher reference before choosing which artifact you intend to keep or inspect. The goal is to establish identity, not to install both copies as a test.
- Open the browser’s Downloads list and note each item’s name, saved location, completion state and source. Google’s Android download guidance describes the Downloads controls and finding saved files.
- Check whether both files really represent the same release, architecture and package format. A different variant is not a duplicate simply because its display name looks similar.
- Calculate each whole-file SHA-256 with the method above, then compare each result with the same trusted reference for the intended artifact.
- Keep the original evidence and source details until the comparison is understood. A file manager’s date order alone does not establish the publisher’s release order.
| Comparison | Interpretation |
|---|---|
| Both hashes match the intended publisher reference | Both copies match that referenced artifact; this does not add a separate safety guarantee. |
| Hashes differ | Do not treat the files as interchangeable. Recheck release, variant, completion and source. |
| Both hashes match each other, but no trusted reference exists | Matching each other does not settle publisher identity or expected release. |
What does a file manager’s “Original” label mean?
Google’s Files duplicate-cleanup instructions describe an Original badge and recommend keeping that copy during cleanup. Interpret it within that cleanup workflow; it is not a statement that an app developer authenticated the file. Review the exact selected items before using a recoverable Trash action, and do not empty Trash merely to finish a verification exercise.
This comparison section was reviewed 20 October 2026. No duplicate APK or cleanup operation was tested. If either download is a saved webpage, return to the publisher’s genuine download route; a different filename cannot convert a webpage into a package.
File hash versus signing-certificate fingerprint
A whole-file checksum describes the downloaded file. A signing-certificate fingerprint describes a certificate used in signing. They are different objects, even when both values are labelled SHA-256.
For technical users with the Android SDK Build Tools, Google’s apksigner documentation provides signature verification and certificate reporting:
apksigner verify --verbose --print-certs example.apkA successful signature check is not a substitute for comparing the signer with a trusted publisher reference. Do not compare a certificate digest from this output with the APK’s whole-file checksum. If an installed app rejects an update, use the separate signature mismatch and data-preservation guide before considering removal.
Does a matching checksum prove that an APK is safe?
No. A download page can present a file and a matching hash together; that agreement alone is not independent evidence about the publisher or the app’s behavior. Treat the source of the reference as part of the verification, not an afterthought. Review the source and permission checklist as a separate step.
Can I compare an XAPK or APKM hash with an APK hash?
Compare the same object the publisher hashed. A container, an APK extracted from it and a set of split APKs are different inputs. Check the reference’s filename and format before drawing conclusions.
What if I only have an Android phone?
If an already trusted file tool offers SHA-256 calculation, use the same whole-file/reference comparison. This guide does not endorse an untested hashing app or require you to upload a private file to an unknown website. A Windows computer is an optional documented calculation route, not a requirement of Android installation itself.
For installation and compatibility help beyond checksum verification, browse the Android app guide directory.
