By Macro Panel Info Editorial · Published 2026-11-07 · Updated 2026-11-07 · 9 min read

Checking a file's checksum sounds like something only developers do, but it's one of the easiest security habits you can pick up, and it takes less than a minute once you've done it once. If you download APK files from outside an app store, it's the quickest way to find out whether the file on your phone is the same one the publisher meant you to have.

This guide assumes no technical background. We'll explain what a checksum is in plain terms, show you how to calculate one on every common device, tell you how to compare the result safely, and be honest about what it can and can't prove. We'll use the Macro Space APK as the example throughout, since that's what most people reading this are dealing with.

What a checksum actually is

Imagine you could take a file and run it through a machine that produces a short code. Feed in the same file twice and you get the same code every time. Change a single letter inside the file, even one tiny bit, and the code comes out completely different. That code is a checksum, or more precisely a cryptographic hash. It's a fingerprint for the file.

The useful part is that you can compare fingerprints without comparing files. If the publisher says "our file's fingerprint is X" and your downloaded copy produces X as well, then your copy is identical to theirs. Not similar. Identical. If it comes out different, something changed along the way: the download was cut off, a server corrupted it, or somebody altered it.

MD5, SHA-1, SHA-256: which one matters?

You'll see several names. They're different recipes for producing fingerprints. MD5 and SHA-1 are older and no longer considered safe against someone deliberately trying to forge a matching fingerprint, though they still work fine for catching accidental corruption. SHA-256 is the modern standard, and it's what you should use and look for. Its output is always 64 characters made of the digits 0-9 and the letters a-f.

If a page only offers an MD5 value, it's better than nothing for catching a broken download, but it doesn't give you much protection against tampering. Prefer SHA-256 whenever it's available.

What a matching checksum does and doesn't prove

This is the part most guides skip, and it's the part that keeps you from a false sense of security.

A match proves your file is identical to the one the checksum was calculated from. That's valuable if you got the checksum from a trustworthy source.
A match doesn't prove the file is harmless. If the original is bad, a perfect copy of it is also bad.
A match is worthless if both the file and the hash come from the same untrusted page. Anyone who can swap the file can swap the number printed next to it.

The strongest approach is to get the checksum from a different place than the file: the developer's page, for example, compared against a copy you downloaded elsewhere. On this site we've published the SHA-256 of the file we host, and we've confirmed it matches the file the developer serves from its own download page. That's the kind of cross-check that actually means something. You can see the current value on the download page.

The value to expect for the Macro Space file

The file we examined, about 8.69 MB, produces this SHA-256 value:

6c4811eea8f25e5ebf91d91380ed94b1a76c99fdf6f7f962509f423f9c373762

If you download the file and your tool prints something different, don't install it. Delete it and download again. If the new download also doesn't match, you're either looking at a different version of the app than the one we examined or you've got a modified copy, and it's worth asking why before you go any further. Developers do release new builds, so a different hash doesn't always mean something sinister, but it does mean you can't rely on our checks for that file.

On Windows

The easiest tool is already built in. Open PowerShell (search for it in the Start menu), then go to the folder where the file is saved. If it's in Downloads, that looks like this:

cd $HOME\Downloads
Get-FileHash .\Macro-Space.apk -Algorithm SHA256

PowerShell prints a small table with a long string under "Hash". That's your fingerprint. If you prefer the older Command Prompt, this does the same job:

certutil -hashfile Macro-Space.apk SHA256

Rather than comparing by eye, let PowerShell do it for you. Paste the expected value in quotes and it will answer True or False:

(Get-FileHash .\Macro-Space.apk -Algorithm SHA256).Hash -eq "6C4811EEA8F25E5EBF91D91380ED94B1A76C99FDF6F7F962509F423F9C373762"

PowerShell compares text without caring about upper or lower case here, so don't worry about the capital letters.

On macOS

Open Terminal and run:

shasum -a 256 ~/Downloads/Macro-Space.apk

The command prints the hash followed by the file name. Compare the first long string with the expected one.

On Linux

sha256sum ~/Downloads/Macro-Space.apk

If you have the expected value saved in a text file in the standard format, sha256sum -c checksums.txt will check it automatically and print OK or FAILED.

On Android itself

You can check the file on the phone before you install it, which is handy if that's the only device you have. There are two ways.

Using Termux. Termux is a free terminal app. After installing it, run termux-setup-storage once to give it access to your files, then:

sha256sum ~/storage/downloads/Macro-Space.apk

Using a hash app. Several small apps on Google Play let you pick a file and display its MD5, SHA-1 and SHA-256. Choose one that has no ads asking for extra permissions, and that only needs access to the file you give it. Be a little picky here, since installing a sketchy "checker" app to verify another app defeats the purpose.

Comparing the result without making mistakes

Sixty-four characters is long, and our eyes are bad at spotting small differences. A couple of habits help.

Compare the whole string. Attackers can generate a fake file whose hash starts and ends the same as the real one, so checking only the first and last few characters isn't enough.
Let the computer compare. Paste both values into any text search, or use the PowerShell comparison above. A "True" is better than your eyes.
Watch for look-alike characters. A capital O and a zero, or a lowercase l and a one, can trip you up when you're reading by eye, though a SHA-256 value only uses 0-9 and a-f, so those letters shouldn't appear at all. If you see one, you've copied something wrong.
Don't trim. Extra spaces at the start or end of a pasted value can cause a mismatch that isn't real.

Why a hash might not match

If the numbers differ, don't panic yet. The most common reason is boring: the download was interrupted and the file is incomplete. Mobile connections and flaky Wi-Fi do this more often than you'd think. Other benign causes include downloading through an app that re-packages files, using a "download accelerator", or grabbing a different version from the same page. Try this sequence:

Delete the file and download it again over a stable connection.
Download directly from the browser, not through a third-party manager.
Check that the file size matches what the source says.
If it still differs, treat the file as untrusted and don't install it.

Going one step further: the signature

The hash tells you whether two files are the same. The signature tells you who made one of them. Every APK is signed, and you can read the certificate with tools you may already have. On a computer with Java installed, this prints the signer's details:

keytool -printcert -jarfile Macro-Space.apk

With the Android SDK's build tools, apksigner verify --print-certs Macro-Space.apk does something similar and also verifies that the signature is intact. In the Macro Space file, the certificate turns out to be Android's generic test certificate, which doesn't name a developer. We explain what that does and doesn't mean in our safety checklist.

Looking the hash up online

Multi-engine scanning sites let you search by hash. If anyone has uploaded a file with that fingerprint, you'll see the combined antivirus results straight away without having to upload anything yourself. That's a nice way to find out whether the file has been scanned before and what the engines made of it. If nothing comes back, it just means nobody has submitted it, not that it's suspicious.

A one-page cheat sheet

Windows (PowerShell)	`Get-FileHash file.apk -Algorithm SHA256`
Windows (Command Prompt)	`certutil -hashfile file.apk SHA256`
macOS	`shasum -a 256 file.apk`
Linux	`sha256sum file.apk`
Android (Termux)	`sha256sum ~/storage/downloads/file.apk`
Signer details	`keytool -printcert -jarfile file.apk`

How files get swapped in the first place

It helps to picture how a tampered file reaches you, because then the value of a checksum is obvious. Most cases fall into a few patterns. One is a repost: someone copies a popular APK, unpacks it, adds some extra code, packs it again and uploads it to a different site with the same name and screenshots. Another is a compromised mirror, where a file-hosting service or a forgotten server is quietly altered. A third is interception: if a download is served over plain HTTP instead of HTTPS, anyone on the network path, such as a public Wi-Fi operator, could in theory replace the file in transit. Modern sites use HTTPS, which largely closes that gap, but it's another reason not to download APKs over an untrusted connection.

In every one of these cases the altered file looks right on the surface. The name, the icon and the file size might all be close. But the hash can't be faked without access to the original publisher's page, so it gives you a quick way to catch the swap.

A mismatch example, step by step

Suppose the expected value ends in ...373762 but your tool prints a value ending in ...a91f04. Here's a sensible way to think. First, are you sure you compared the right file? People often hash an older download with a similar name, such as Macro-Space(1).apk, because browsers add a number when the name already exists. Check the file in your folder. Second, is the size the same? A size that's much smaller is a strong sign of an incomplete download. Third, delete and re-download, then hash again. If it matches now, the first download was damaged. If it still doesn't match and the size looks the same, you're probably looking at a different build, and that means none of the checks we've done on our copy apply to yours.

Hash, signature, Play Protect: how they differ

Checksum (SHA-256)	Tells you whether your file is identical to a reference copy. Doesn't tell you who made it or whether it's safe.
Digital signature	Tells you which key signed the app and lets Android spot tampering after signing. Only as informative as the key's identity.
Play Protect	Scans for known bad behaviour and unknown-developer risks. Good safety net, not a guarantee.
Multi-engine scan	Cross-checks the file against many antivirus engines. Helpful but not conclusive.

Each tool answers a different question, and none of them answers all of them. That's why the safety checklist uses several together.

Checking many files at once

If you keep a folder of APKs, you can hash all of them in one line in PowerShell:

Get-ChildItem *.apk | Get-FileHash -Algorithm SHA256 | Select-Object Hash, Path

That prints a tidy list, which is handy if you want to find out whether two files with different names are really the same, or to keep a record of what you've installed and when.

Questions people ask

Can two different files have the same SHA-256 hash? In theory yes, because there are more possible files than possible hashes, but finding such a pair deliberately is, as far as anyone knows, computationally out of reach. For practical purposes, the same hash means the same file.

Can someone work out the file from its hash? No. A hash only goes one way. It's a fingerprint, not a compressed copy.

Why is it always 64 characters? SHA-256 produces 256 bits, and each hexadecimal character stands for 4 bits, so 256 divided by 4 gives 64 characters.

Will the hash be the same on my phone as on my laptop? Yes. The hash depends only on the bytes in the file, not on the device, the operating system or the tool you used.

Does opening or moving the file change the hash? No. Copying or renaming doesn't alter the contents. But if you unzip and re-zip an APK or edit it in a "modifier" app, the bytes change and so does the hash.

Once you've checked, what next?

A matching hash is the end of the verification step, not the end of the process. Before you install, you still need to allow your browser or file manager to install unknown apps, which is explained in our guide to that setting. If you're ready to go, the full install guide walks through the whole thing, and if something goes wrong during installation, the troubleshooting article covers the usual culprits. And if you're still wondering what the app is before you decide, start with the overview.

How to verify an APK's SHA-256 checksum on Windows and Android