Questions and answers
Frequently asked questions
Mostly about verification: what the numbers on a listing mean, which checks are worth your time, and where the limits of those checks are. Where an answer is short because the honest answer is short, it is short.
1. Verifying a download
What does the SHA-256 on a listing actually prove?
It proves integrity, not safety. A SHA-256 hash is a fingerprint of a file's bytes: the same file always produces the same 64-character result, and changing a single bit changes roughly half of it. If the hash you compute matches the one published, you are holding the same file we hold, byte for byte — nothing was corrupted, injected or substituted in transit. It tells you nothing about whether the app is trustworthy. A malicious app has a perfectly valid hash.
How do I compute a file's SHA-256?
Every desktop operating system ships with a tool for it. On macOS or Linux, run shasum -a 256 app.apk. On Windows, certutil -hashfile app.apk SHA256, or Get-FileHash app.apk -Algorithm SHA256 in PowerShell. It takes a second or two even on a large APK, and you can do it before the file ever reaches your phone.
Can I just check that the first and last few characters match?
No. Matching a short prefix and suffix takes a few thousand attempts, which is nothing — it is far easier than producing a genuine collision, and it is exactly the check an attacker expects you to make. Compare the whole string with a machine rather than your eyes.
The hash does not match. What should I do?
Delete the file and do not install it to see what happens. A mismatch has boring explanations, such as a truncated download or a mirror serving an older build, and alarming ones, such as the file not being what was published. You cannot tell which from the hash alone. Download again, ideally from a different network. If it still does not match, report the listing and include both hashes.
2. Signing certificates
What does a signing certificate prove?
Continuity of authorship, and nothing else. Android records the certificate an app was installed with and requires every update to carry the same one. So a matching certificate proves this build came from whoever produced the version already on your device. It does not prove the developer is honest, competent, or that the app is safe. It is a narrow claim, but it is the one that catches repackaged apps.
The certificate says it is from a company I recognise. Does that mean anything?
No. Android signing certificates are self-signed, so no certificate authority checks them and nothing stops anyone from generating a key whose certificate names any company they like. The name field is free text typed by whoever made the key. The SHA-256 fingerprint is the identity; the name is only a label.
How do I read the certificate on an APK myself?
Use apksigner, which ships with the Android SDK build-tools: apksigner verify --print-certs --verbose app.apk. The line that matters is the signer's SHA-256 digest. Compare that between the build you have and the build you are about to install.
Why do the Play version and the developer's own build have different certificates?
Because of Play App Signing. For many apps, Google holds the app signing key and signs the build delivered to devices, while the developer signs their upload with a separate key that never reaches your phone. So the developer's own build from their website can legitimately carry a different certificate than the Play build of the same app. Both are genuine, and neither can update the other on a device.
3. Installing and sideloading
An install failed with a signature mismatch. How do I get past it?
You should not want to. The error means an app with the same package name is already installed and was signed by a different key. Uninstalling the existing app removes the conflict and lets the new file take its place, its package name and its permissions — which is precisely what the check exists to prevent. Compare the two certificate fingerprints first. If you cannot name the other author, do not proceed. There is a longer article on this.
Is sideloading safe?
It is survivable rather than safe, and the difference matters. Modern Android helps: the install permission is granted per source rather than globally, sideloaded apps cannot be given Accessibility access through the ordinary prompt, very old apps cannot be installed at all, and Play Protect scans sideloaded files on most devices. But you are still the one deciding whether a file deserves to run, and no platform feature makes that decision for you.
When should I sideload instead of using the store?
When you can say what the store's copy fails to do for you. Good reasons: you want an older version after an update broke something, the app is not offered in your region, it was pulled from the store but you rely on it, or your device has no Play services. Wanting a paid app for free is not a reason — cracked and modded builds are where the overwhelming majority of Android malware lives.
Will a sideloaded app still get updates?
Only if the build you installed carries the same signing certificate as the store's build. If you installed a developer's own build and the Play copy is signed by Google under Play App Signing, Play cannot update it at all. The app stays at the version you installed until you update it by hand, which makes security fixes your responsibility.
Which permissions should make me suspicious?
Ones with no plausible relationship to what the app claims to do. Accessibility Service is the most powerful on the platform — it can read everything on screen and act for you — and it is what banking trojans want most. Device admin can lock or wipe the device and resist uninstallation. SMS and call log access is the standard route to intercepting one-time passcodes. Install unknown apps lets a dropper fetch its payload later. Display over other apps enables invisible overlays that capture taps.
4. About this catalogue
Does APKBrowse scan apps for malware?
No. We record the SHA-256 of every build we hold and the fingerprint of the certificate that signed it, and we link the official store first where one exists. Those are provenance checks: they establish where a build came from and whether it changed on the way to you. No antivirus engine runs here, and nothing on this site is a verdict on what an app does once it is running.
What does 'signature verified' on a listing mean?
Exactly one thing: the certificate on this build matches the certificate on the earlier releases of the same package that we hold. A mismatch blocks approval outright. It is a mechanical check that catches repackaging, and it is not a statement that the app is safe.
Why is the store link above the download button?
Because when a current store build exists and does what you need, installing an APK instead is strictly worse. A store binds the app to an accountable developer account, scans it, updates it automatically, and can remove it from every device if it turns out to be harmful. Sideloading gives up all four and offers nothing in exchange except a slower path to the same file.
Can I request an app that is not listed?
No. There is no public request queue, and going to find a file because someone asked for it by name is the exact thing this catalogue exists to avoid — the only provenance such a listing would have is that we found it. Apps get here when a publisher submits a build and it passes review. The request page covers what to do instead.
How do I report a problem with a listing?
Use the report action on the app's page. Reports go straight to the moderation queue and a moderator can delist an app while it is investigated. You do not need an account. Include the version, what you observed, and the SHA-256 of the file you downloaded — that last detail is what distinguishes a bad listing from a bad download.
Are the apps on this site real?
Yes. The listings are real, open-source apps mirrored from F-Droid's repository, chosen because F-Droid publishes the signing certificate and file hash for every build — the provenance this site is built around. We link each app's official F-Droid page and download rather than hosting our own copy. The guidance on the site applies to any APK from any source.
Still reading
The safety guide walks through installing an APK from start to finish, and the blog takes each of these answers apart at length. If something here is wrong, the report action on any listing reaches a moderator.