APK checksum calculator & quick inspector
Pick an APK to get its SHA-256 and SHA-1, verify it against a published checksum, and see what's inside. The file is read locally and never leaves your device.
Why check an APK's checksum?
A checksum (hash) is a fingerprint of the file. If even one byte changes — a broken download, or a tampered copy — the SHA-256 changes completely. Comparing it with the one the developer published tells you that you have the exact same file.
Checksum vs signature
| Checksum (SHA-256) | APK signature | |
|---|---|---|
| Proves | This file = that file | Who built it; it wasn't modified since signing |
| Changes when | Any byte changes | Signing key changes |
| Checked by | You, manually | Android, at install |
For signature details on a computer: apksigner verify --print-certs my-app.apk.
Publishing a checksum for your own app
If you share your APK from a website, list its SHA-256 next to the download button. On a Mac or Linux: shasum -a 256 my-app.apk; on Windows: certutil -hashfile my-app.apk SHA256. Update it with every release.
Questions people ask
Is my APK uploaded anywhere?
No. The file is read with the browser's File API and hashed with Web Crypto on your device.
Why doesn't it show MD5?
Browsers' built-in crypto doesn't offer MD5, and MD5 is no longer safe for verification. Use SHA-256.