What this APK comparison checks
The auditor validates bounded ZIP structure and CRCs, decodes literal identity and SDK values from Android binary XML, inventories native ABIs, locates complete v1/JAR signature sets, and decodes recognized v2, v3, and v3.1 ID-value pairs immediately before the central directory. It compares package names, numeric versionCode direction, decoded certificate SHA-256 fingerprints, and removed scheme evidence.
Why matching certificates matter
Android's app-signing documentation explains that application signing establishes update and shared-identity relationships. The v2 format stores whole-file signing evidence in an APK Signing Block before the ZIP central directory; v3 adds key-rotation lineage, and v3.1 supports targeted rotation for newer Android versions. A different current fingerprint is therefore not automatically invalid: a verified rotation lineage can be legitimate.
Why this page does not say “signature valid”
Complete APK verification recomputes protected content digests, validates the chosen signature algorithm and public key, checks signer records and stripping protection, and—where applicable—verifies every proof-of-rotation link. This JavaScript preflight deliberately inventories evidence only. Confirm every release with the Android SDK's apksigner, then test installation or upgrade on supported devices.
Validation boundary
This is not an installer, malware scanner, decompiler, or authoritative signature verifier. It does not execute code, resolve resource-table references, inspect DEX behavior, determine Play App Signing state, validate v4 .idsig sidecars, prove a rotation lineage, or guarantee that Android accepts an update. Keep trusted originals and use controlled SDK/device verification before release.
Frequently asked questions
Why does a candidate with another certificate remain “unproven”?
A key rotation can legitimately change the current signer while retaining a verified lineage. This tool refuses to label the update valid or invalid without performing the full platform verification procedure.
Why is v4 absent?
APK Signature Scheme v4 uses a separate .idsig file. This first version accepts APK files only and inventories their embedded schemes.
Can I compare APKs from different stores?
Yes, but store-managed signing may intentionally produce different certificates. Treat the report as evidence for investigation, not proof of tampering.