Run apksigner verify on the APK, add the print-certs option to see the signing certificate, and compare that certificate fingerprint with a value the publisher gave you separately. A pass means the signature is consistent. It tells you who signed it, not that the app is safe.
Get the tool
apksigner is part of the Android SDK build tools. Install the command line tools or Android Studio, then find it in the build-tools folder for your installed version. You do not need an Android device to run it.
Basic verification
Android's reference page gives this form:
apksigner verify app.apk
By default it checks whether the signatures are expected to verify on all the Android platforms the APK supports. To test against a lower floor, the same page shows the min-sdk-version option, for example with API level 15.
See who signed it
Add the print-certs option:
apksigner verify --print-certs app.apk
The reference describes this option as showing information about the APK's signing certificates. A second option, print-certs-pem, also prints each certificate in PEM form. Note the certificate fingerprint it reports. The documentation page we read does not show sample output, so run it once on an app you trust to learn the layout.
Compare to a known value
A signature check on its own only proves the APK is internally consistent. An attacker can sign a modified app with their own key and it will verify fine. The value comes from comparing the signer.
- Get the expected certificate fingerprint from the publisher, on a channel separate from the APK download.
- Compare it to what print-certs reports.
- If they differ, do not install.
Our walkthrough of installing the Safeguard Android APK and verifying its checksum uses the checksum route for the same reason.
Which signature schemes appear
Modern APKs can carry several signature schemes. If you want to know what v2 and v3 add, read APK signature schemes explained.
Limits
Verification does not check what the app does, what permissions it asks for, or whether the publisher is honest. Treat it as one step in a wider routine, alongside the questions in evaluating a native app before installing.
When the check fails
A failure can mean the file was corrupted in transit, was modified after signing, or uses a signature scheme the checked platform range does not support. Download again over a trusted connection and retry first. If it fails twice, do not install it. Report it to the publisher using a contact from their official site, not one printed on the failing download. If the certificate differs from the expected one but verification passes, you probably have a repackaged app signed by someone else.
Quick check
Verify passes. Is the APK from the real publisher?
Not necessarily. Compare the signing certificate fingerprint with a value from the publisher.
Do I need to root a phone to check an APK?
No. apksigner runs on a computer against the file.
Sources
Last reviewed: 19 October 2026.
