APK Verification Policy

Our name is our promise. Every APK on SignedAPK is the developer’s original, unmodified file. Here’s how we make sure.

Why signatures matter

Every Android app is digitally signed by its developer using a private key that only they hold. If anyone changes even one byte of the file, for example to add malware or unlock paid features, the original signature no longer matches. Android won’t install a modified file as an update to the real app, and we won’t publish it.

Our verification steps

1. Trusted source. We obtain files from Google Play or directly from the developer.
2. Signature check. We check the file’s signing certificate. For updates, it must match the certificate of earlier versions. For new apps, it must match the developer’s other apps or the version on Google Play.
3. Fingerprints published. We publish the certificate’s SHA-256 fingerprint and the file’s SHA-256 hash, so you can confirm your download is identical to ours.
4. Security scan. We scan every file with VirusTotal and link the report. Any credible detection means the file is held and investigated.
5. Logged and dated. We record who verified each file and when, and show the “Last verified” date on the download page.

If we cannot verify a file, we do not publish it. No check can guarantee an app is free of every risk, so we also recommend reviewing its permissions before installing.

What we host, and what we don’t

• ✓ Free apps, older versions of free apps, and apps unavailable in some regions, all as original files.
• ✗ Paid apps, “MOD”, cracked, patched or “premium unlocked” versions, and apps that stream unlicensed content.
• ✗ Custom installers, downloader apps or bundled software.

Android developer verification (2026)

Google is rolling out a requirement for apps on certified Android devices to come from identity-verified developers, including apps installed outside Google Play. Our download pages show whether an app’s developer is verified, and our install guide explains what you’ll see on your phone.

Check a file yourself

Advanced users can confirm a download with Android’s apksigner tool and compare the certificate fingerprint and file hash with the values on our download page. If they don’t match, don’t install the file, and please tell us at hello@signedapk.com.