How to Verify Android APK Signatures Manually with ADB and apksigner

When you sideload an APK that isn’t from the Play Store, the biggest question is: Is this file genuine? Android enforces a cryptographic signature on every app package, but the signature is only useful if you actually check it before installing. This tutorial shows you, step by step, how to extract an APK from any Android phone (no root required) and verify its signature with the official apksigner tool that ships with the Android SDK.

Why verifying an APK matters

Every APK is signed with a private key belonging to the developer. During installation Android compares the embedded signature with the one stored on the device. If the signatures don’t match, the system blocks the install. However, a malicious actor can re‑package a legitimate app, sign it with their own key, and distribute the altered file. By verifying the signature yourself you can confirm that the APK you hold matches the original developer’s certificate.

Before you start

• Computer requirements: Windows 10/macOS 10.15+/Linux with Java 8+ installed.
• Android device: Any phone running Android 5.0 (API 21) or newer. No root access is needed.
• USB cable: Use a data‑capable cable and enable USB debugging (Settings → Developer options → USB debugging).
• Internet connection: Required only to download the Android SDK Platform‑Tools and apksigner binary.

Step 1 – Install ADB and apksigner

1. Download the Android SDK Platform‑Tools zip for your OS.
2. Extract the zip to a convenient location, e.g., C:\adb on Windows or ~/adb on macOS/Linux.
3. Add the folder to your system PATH so you can call adb from any terminal.

   # Windows (PowerShell)
   $env:Path += ";C:\adb"
   # macOS / Linux (bash)
   export PATH="$PATH:$HOME/adb"
   

4. Verify the installation by opening a terminal and running:

   adb version

   You should see something like Android Debug Bridge version 1.0.41.
5. The apksigner tool lives in the build-tools directory of the full Android SDK. If you don’t have the full SDK, download the Command‑line tools and install the latest build-tools package:

   # Example for macOS/Linux
   mkdir -p $HOME/Android/Sdk/cmdline-tools
   cd $HOME/Android/Sdk/cmdline-tools
   # unzip the command‑line‑tools zip here
   # Then use sdkmanager to install build‑tools
   $HOME/Android/Sdk/cmdline-tools/latest/bin/sdkmanager "build-tools;33.0.2"
   

   After installation, apksigner will be at $HOME/Android/Sdk/build-tools/33.0.2/apksigner. Add that folder to PATH as well.

Step 2 – Pull the APK from the device

Android stores installed apps in /data/app (for user apps) or /system/priv-app (for system apps). Access to these folders is restricted, but you can still retrieve the APK via adb pull because the package manager exposes a public “apk path” through the pm path command.

1. Connect your phone via USB and confirm the debugging prompt.
2. Open a terminal and list the device:

   adb devices

   You should see your device’s serial number.
3. Identify the package name of the app you want to verify. You can find it in the Play Store URL or via:

   adb shell pm list packages | grep -i partial‑name

   Example: to locate the Facebook app:

   adb shell pm list packages | grep -i facebook

   Output: package:com.facebook.katana
4. Ask the package manager for the APK location:

   adb shell pm path com.facebook.katana

   Expected output: package:/data/app/com.facebook.katana-1/base.apk
5. Copy the APK to your computer:

   adb pull /data/app/com.facebook.katana-1/base.apk ./facebook.apk

   The file facebook.apk now resides in your current directory.

Step 3 – Verify the APK signature

The apksigner verify command checks both the integrity of the ZIP structure and the cryptographic signature. It also reports which signing scheme (v1‑JAR, v2‑APK, v3‑APK) the app uses.

1. Run the verification command:

   apksigner verify --verbose facebook.apk

2. If the APK is correctly signed, you’ll see output similar to:

   Verifies
   Verified using v2 scheme (APK Signature Scheme v2)
   Verified using v1 scheme (JAR Signature)

   The presence of both v1 and v2 indicates backward compatibility.
3. If the signature is missing or corrupted, the tool prints an error, e.g.:

   DOES NOT VERIFY
   ERROR: No signatures found in the APK.
   ERROR: Failed to verify the APK.

   In that case, do not install the APK – it may have been tampered with.

apksigner verify --print-certs facebook.apk

Step 4 – Compare the fingerprint with the official source

Most reputable developers publish the SHA‑256 fingerprint of their signing certificate on their website or in the Play Store listing (under “App details”). If you can’t find it, you can retrieve the fingerprint directly from the Play Store APK using the same method, then compare the two values.

1. Download the official APK from a trusted source (e.g., the Play Store using a reputable downloader).
2. Run apksigner verify --print-certs official.apk and note the SHA-256 digest value.
3. Compare the digest with the one you obtained from the sideloaded APK. They must be identical.

Step 5 – Optional – Verify the APK’s integrity with SHA‑256 checksum

Signature verification ensures the APK is signed, but it does not guarantee the file wasn’t corrupted during transfer. Compute a checksum and compare it with the one published by the developer (if available).

# Windows PowerShell
Get-FileHash -Algorithm SHA256 .\facebook.apk

# macOS / Linux
shasum -a 256 facebook.apk

Match the hash string against the developer’s published value.

Troubleshooting common issues

ADB cannot see my device

• Make sure USB debugging is enabled (Settings → Developer options → USB debugging).
• On Windows, install the appropriate USB driver for your phone (Google USB driver for Pixel, OEM driver for Samsung, etc.).
• Try a different USB cable or port; some cables are charge‑only.

‘pm path’ returns “Error: package not found”

• Double‑check the package name; it is case‑sensitive.
• Use adb shell pm list packages -f to see the full list with paths.

apksigner says “No signatures found” even though the app installs fine

• Older apps may only use the v1 JAR signing scheme, which apksigner still reports. Ensure you are using the --verbose flag.
• If the APK is a split APK (multiple .apk files), you need to verify each part individually.

  # Example for a split APK set
  apksigner verify --verbose base.apk
  apksigner verify --verbose split_config.en.apk

Checksum mismatch but signature verifies

• Some developers release multiple builds (debug vs. release). Ensure you are comparing against the exact build you have.
• Re‑download the APK from the source; a corrupted download can change the hash while preserving the signature.

Safety checklist before installing a verified APK

• Signature matches the official fingerprint.
• SHA‑256 checksum (if published) matches.
• The app’s requested permissions are reasonable (check via Settings → Apps → App → Permissions).
• Run a quick scan with a mobile antivirus app for extra peace of mind.

Once all checks pass, you can install the APK with:

adb install -r facebook.apk

The -r flag replaces any existing version without losing data.

Wrapping up

Verifying an APK’s signature is a small extra step that dramatically reduces the risk of installing tampered software. By pulling the APK with ADB, using the official apksigner tool, and comparing the certificate fingerprint, you gain confidence that the app truly comes from its claimed developer. The same workflow works for any Android app – whether it’s a game, a productivity tool, or a custom ROM component.

Keep this guide bookmarked; the next time you receive an APK from a friend, a forum, or a backup, you’ll have a reliable, no‑root method to confirm its authenticity before it ever touches your device.