Verifying an APK signature
The correct way to verify an APK file is to use
apksigner is part of the Android build tools (Andorid SDK), therefore you may find multiple versions installed, one for each build-tools version installed.
One example path within the Android SDK to
For more details on how to get apksigner see last chapter of this answer.
Execute apksigner this way:
apksigner verify --verbose --print-certs "Signal-website-universal-release-4.49.13.apk"
Verified using v1 scheme (JAR signing): true
Verified using v2 scheme (APK Signature Scheme v2): true
Verified using v3 scheme (APK Signature Scheme v3): true
Number of signers: 1
Signer #1 certificate DN: CN=Whisper Systems, OU=Research and Development, O=Whisper Systems, L=Pittsburgh, ST=PA, C=US
Signer #1 certificate SHA-256 digest: 29f34e5f27f211b424bc5bf9d67162c0eafba2da35af35c16416fc446276ba26
Signer #1 certificate SHA-1 digest: 45989dc9ad8728c2aa9a82fa55503e34a8879374
Signer #1 certificate MD5 digest: d90db364e32fa3a7bda4c290fb65e310
Signer #1 key algorithm: RSA
Signer #1 key size (bits): 1024
Signer #1 public key SHA-256 digest: 75336a3cc9edb64202cd77cd4caa6396a9b5fc3c78c58660313c7098ea248a55
Signer #1 public key SHA-1 digest: b46cbed18d6fbbe42045fdb93f5032c943d80266
Signer #1 public key MD5 digest: 0f9c33bbd45db0218c86ac378067538d
<skipped a lot of warnings>
Estimate the authenticity of the signer certificate
Now you have verified the APK, but you still don't know if you can trust the person/organization who has signed the APK file. This is because on Android APK signatures use by definition self-signed certificates. If you can trust a certificate is therefore a difficult question. The only way is to check the other apps that have been signed using the same certificate.
The only way I know to do so is to use online PlayStore crawling services like androidobservatory.org. It has an API for checking which apps have been signed by the same certificate using the certificate SHA-1 digest:
Edit: apkmirror.com also allows to search for the certificate digest. Just enter the plain SHA-1 or SHA-256 certificate digest (without colons or spaces) in the search field:
On this page you can see all the other APK files on Google Play Store that are signed with the same certificate.
Getting and executing apksigner
Apksigner is a Java tool and Google provides for start-up a batch file
apksigner.bat(Windows) respectively a shell script
apksigner.sh (Linux, MacOS).
As mentioned before it is included in each build-tools version of Android SDK. But it is not placed in PATH so you can not simply open a command-prompt or terminal and execute
apksigner, instead you have to manually provide the full path to
If you don't want to install the whole Android SDK (with or without Android Studio) you can directly download build tools and extract and execute apksigner. Links to the all build-tools are provided on this website (the provided links go to the original Google download locations).
I prefer apksigner from build-tools v30:
You only need the file
lib/apksigner.jar from the archive. Extract it and open a shell in the folder. Then execute
java -jar apksigner.jar.
To execute you need Java 9 or higher (best Java 11 or 17).
Using this direct approach the command to execute apksigner is
java -jar apksigner.jar verify --verbose --print-certs "Signal-website-universal-release-4.49.13.apk"
Or if you use full path names - replace the
<..> sections with the appropriate path that works on your OS:
<path to java 9+>/java -jar <path to apksigner>/apksigner.jar verify --verbose --print-certs "<absolute or relative path to apk to be verified>"