Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Some free applications on Google Play are limited to the United States so the rest of the world has to use dodgy sites to get them. However the security of such sites are questionable as the apps might be modified and contain some kind of malware.
Is there a way to get the SHA or MD5 hash of the apk file from the play store so it can be compared with the downloaded one to make sure that it's safe?

share|improve this question
I don't think there md5/sha5 sum would be a good idea. However all apk's are signed by the developer so if you have another app from the same author compare the signatures and check the .apk sig itself. EDIT: see eldarerathis' link above – ce4 Nov 8 '12 at 17:11
the other app from developer is limited to so we can't download and compare – mike Nov 8 '12 at 18:10
sha-3 sum is a very good idea because you can't clone it faster than 1000 years and you can simple compare hash of what you downloaded with what google play say on app page. it can't be easier and safer. – mike Nov 8 '12 at 18:16
I know what SHA3 is. I was asking about the figure of "1000 years". I'm not talking about cloning (what is that anyway?) but making another apk that has the same checksum as the original. It certainly doesn't require 1000 years given adequate processing power. – Richard Borcsik Nov 8 '12 at 19:41

No it isn't. It would be also possible to make the modified package have the same md5 as the original, so this wouldn't be too secure.
One solution is to remove your SIM card and use a VPN app like TunnelBear VPN to circumvent regional restrictions or an alternative market like Amazon App Store or GetJar.

share|improve this answer
no dear VPN won't work with new google store. and MD5 was example. SHA-512 or SHA-3 is completely secure with today computing power ... its sad google don't do that. i think just this can prevent millions of cell phones and tablet don't get infected with trojan horses – mike Nov 8 '12 at 16:11
Why do you say that VPN doesn't work? I'm using it, and it works. Google is a corporation not a non-profit. It has a financial interest in users downloading apps from the Play Store. So Google doesn't gain anything from adding hashes. Use a VPN like I said above. It works. (Also most people don't know what checksums or hashes are. ) – Richard Borcsik Nov 8 '12 at 16:29
for paid maybe but for free apps VPN won't work. google store check your sim card number and understand your real country ... – mike Nov 8 '12 at 16:37
@mike Your operators code to be exact. So how do you circumvent that? There are several market enabler apps, or just take out the sim card. – Richard Borcsik Nov 8 '12 at 16:57
"all the people are idiot" Yes. Among other things, more people are technologically illiterate than literate.… There're also people who don't have internet on their phone, don't have a Google account, don't have Play Store. – Richard Borcsik Nov 8 '12 at 19:38

The Guardian Project's free and open-source app Checkey does much of what you're looking to do.
via F-Droid:
"Checkey is a utility for getting information about the APKs that are installed on your device. Starting with a list of all of the apps that you have installed on your device, it will show you the APK signature with a single touch, and provides links to and to easily access the profiles of that APK. It will also let you export the signing certificate and generate ApkSignaturePin pin files for use with the TrustedIntents library."

share|improve this answer

The only way is if you first download it then find its MD5 or SHA1 hash.

Or, use the site but you have to use the full qualified name of the app.

share|improve this answer
The website seems to be legitimate, make sure to disclose any affiliation with the site. – Aaron Gillion Mar 14 at 14:44
This doesn't make any sense to me. If I can already download the app from Play Store then the question would not exist at first place. Why would I bother with a checksum since the problem wouldn't exist anymore. And using checksum of an apk downloaded from a third-party site as a base checksum to compare with makes the whole point of verification, moot. – Firelord Mar 14 at 17:22
Looks like a useful site, but agreed with Firelord that it is virtually worthless as a method of file verification. – Matthew Read Mar 14 at 21:42

protected by Community Mar 29 at 19:23

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.