How we verify APKs
Most sites ask you to trust a badge. We show the actual checks on every app page — and where we can confirm a file is the developer's genuine build, we say so plainly. Here's exactly what we do on APK Downly.
1. It has to be free and genuine
We only list free apps, and only the real thing — no paid apps, and no cracked or "premium unlocked" copies. If it isn't the app the developer actually released, it doesn't get in.
2. We check the signature against the developer
Every Android app is signed with the developer's private certificate. Where we have a developer's certificate on record, we check that the file's signature matches it — proof it's the original build and hasn't been repackaged, tampered with, or modified. Each app page shows the result: a green Verified badge when the signature matches, or a clear warning when it doesn't.
3. We screen out fakes and repacks
Crowd-sourced app listings are full of fakes. We reject the common tells: bogus version numbers, stub files far too small to be the real app, and split bundles passed off as a complete APK. If a file looks like a fake, a repack, or an incomplete build, it doesn't get listed.
4. We publish the checksum
We show the file's fingerprint — its SHA-256, and where available its SHA-1 signature and MD5 — right on the app's page. After downloading, you can compute the hash yourself and confirm it matches — proof you got the exact file we listed, with nothing added in transit.
5. We host our own copy
Once a file passes our checks, we host it ourselves — so what you download is the exact file we verified, not a link to someone else's server that could change or disappear.
The result of these checks is shown on each app's page. Where a file's signature matches the developer's certificate, you'll see a green Verified badge. Where we can't confirm it, we show the file's details honestly rather than guess. We don't scan files ourselves for malware — for that, keep Google Play Protect on, and download only apps whose signature we've verified.