How to verify an APK with its SHA-256 checksum
By AltFTool Team · Updated 1 Nov 2026
A SHA-256 checksum is a 64-character fingerprint of a file. If even one byte changes, the fingerprint changes completely. Matching it against the value on the official page proves your download is the original, untouched file.
The quick way: in your browser
- 1
Open the checker
Go to altftool.com/apps/verify on your phone or computer.
- 2
Pick the APK
Choose the downloaded .apk file. It is hashed on your device and never uploaded.
- 3
Read the result
A green match names the AltFTool app and version. No match means the file is not one we published: delete it.
On a computer
- Windows (PowerShell): Get-FileHash .\speed-test.apk -Algorithm SHA256
- Windows (Command Prompt): certutil -hashfile speed-test.apk SHA256
- macOS: shasum -a 256 speed-test.apk
- Linux: sha256sum speed-test.apk
Compare the output with the SHA-256 shown on the app's page. Capital or small letters do not matter.
What a checksum does and does not tell you
- It proves the file is identical to the one the publisher listed.
- It does not prove the app itself is safe; that depends on trusting the publisher.
- The signing certificate fingerprint (also on each app page) proves updates come from the same developer. Android refuses to install an update signed with a different key.
Questions
Where do I find the official SHA-256?
Every AltFTool app page lists the SHA-256 of the current APK next to the download button, with a copy button.
Is MD5 or SHA-1 good enough?
Use SHA-256. MD5 and SHA-1 have known collision attacks, so two different files can be made to share a fingerprint.
