Google’s advanced flow for sideloading is rolling out ahead of the developer verification requirement. The new prompt confirms an app comes from a verified developer identity, which is a real step forward against outright malware. What it does not do is tell you whether a specific APK from that developer matches the one on the Play Store, whether the signing certificate is the one you expect, or which permissions the package will ask for after install. That last mile still falls on you.
These six Android apps inspect installed and downloaded APKs at the signature, hash, and permission level. If you sideload from any source other than Play, one of these belongs on your phone.
What to look for in an APK verification app
- SHA-256 fingerprint display for the signing certificate.
- V1, V2, V3, and V4 signature scheme detection.
- Full permission list, including undeclared or hidden permissions.
- Trackers and analytics library detection.
- Ability to diff a downloaded APK against an installed version before you install the new one.
- Export of reports as text or CSV.
- Open source, ideally, because you are trusting this app to inspect other trusted apps.
Quick comparison
| App | Best for | Platforms | Free plan | Starting price/mo | Rating |
|---|---|---|---|---|---|
| APK Analyzer | Open-source everyday use | Android | Fully free | Free | 4.7 on Play Store |
| Package Info Viewer | Simple certificate lookup | Android | Fully free | Free | 4.5 on Play Store |
| App Manager | Power-user inspection | Android (root helpful) | Fully free | Free | 4.6 on F-Droid mirrors |
| Warden | Anti-tracker and privacy check | Android | Fully free | Free | 4.4 on F-Droid mirrors |
| MyAppSecurity | Security auditor UI | Android | Free with ads | Premium around $2 one-off | 4.3 on Play Store |
| AppChecker | Framework and library detection | Android | Free with ads | No paid tier | 4.4 on Play Store |
The apps
1. APK Analyzer, best overall
APK Analyzer by Martin Styk is the open-source Swiss army knife for Android package inspection. Point it at an installed app or an APK file on disk and it gives you the SHA-256 fingerprint of the signing cert, the full permission tree, the certificate issuer, and a list of exported activities and services. No ads, no telemetry, no signup.
Where it falls short: UI is functional rather than beautiful. Tracker detection is not built-in, so pair it with Warden.
Pricing:
- Free open source.
- No paid tier.
Platforms: Android.
Bottom line: The first install on any phone that touches sideloaded APKs.
2. Package Info Viewer, best for a quick check
Package Info Viewer is the simplest option in this list. Open the app, tap a package, and see version, install source, signing certificate fingerprint, and permissions. Nothing more. When you just need to confirm “this APK really was signed by the developer I expect,” it does the job in three taps.
Where it falls short: No comparison feature, no tracker detection, no signature scheme breakdown. Great as a lookup tool, not as an auditor.
Pricing:
- Free open source.
- No paid tier.
Platforms: Android.
Bottom line: Get it if you want a permanent home-screen shortcut for spot checks.
3. App Manager, best power-user tool
App Manager is the closest Android has to a professional package inspector. It shows every activity, service, and receiver, dumps the manifest as readable XML, exposes signing block v1 through v4, detects known trackers, and can even back up split APKs. Some features unlock more depth on rooted devices.
Where it falls short: Steep learning curve. The UI shows everything at once, which is powerful and overwhelming.
Pricing:
- Free open source.
- No paid tier.
Platforms: Android. Root or Shizuku is optional but unlocks the most useful features.
Bottom line: The pick if you audit APKs regularly and want the deepest look without a desktop.
4. Warden, best for tracker and analytics detection
Warden by Vishal Nehra scans your installed apps for known tracker libraries and analytics SDKs. It cross-references against the Exodus Privacy database, so a Firebase-heavy or AppLovin-heavy app is flagged immediately.
Where it falls short: Does not analyze APK files off disk. Verifies apps only after they are installed.
Pricing:
- Free open source.
- No paid tier.
Platforms: Android.
Bottom line: The right sidekick to APK Analyzer, one focuses on signatures, the other on trackers.
5. MyAppSecurity, best security-auditor UI
MyAppSecurity wraps signature and permission checks in a scorecard interface. It grades each installed app on a scale, flags dangerous permission combinations, and lets you export a full report. Comfortable for less technical users who want a summary instead of raw data.
Where it falls short: Scoring uses proprietary weights that are not always transparent. Ads on the free tier interrupt scans.
Pricing:
- Free with ads.
- Premium unlock at around $2 as a one-off removes ads and adds report exports.
Platforms: Android.
Bottom line: Get it if you want the audit results in plain language for a family member.
6. AppChecker, best for framework detection
AppChecker identifies the frameworks and libraries an APK was built with (React Native, Flutter, Unity, Ionic, native Kotlin), lists the SDK version target, and flags outdated compileSdkVersion values. Useful when you are debugging why a sideloaded APK misbehaves on newer Android versions.
Where it falls short: Signature verification is basic. Ad-supported free tier.
Pricing:
- Free with ads.
- No paid tier at time of writing.
Platforms: Android.
Bottom line: Niche pick for developers and tinkerers who want to know how an APK was built.
How to pick the right one
- If you install one app for signature checks: APK Analyzer.
- If you want a home-screen shortcut for quick lookups: Package Info Viewer.
- If you audit APKs seriously: App Manager.
- If you care most about trackers and analytics: Warden.
- If you want a human-readable scorecard: MyAppSecurity.
- If you debug or reverse-engineer APKs: AppChecker.
FAQ
What is APK signature verification?
Every Android APK is signed with a developer certificate. Verification confirms the APK you have was signed by the same certificate as the one you trust. A mismatch usually means the APK was modified or repackaged after the developer released it. Android itself checks the signature at install time, but only against the version already installed.
How do I check an APK’s SHA-256 fingerprint on Android?
Install APK Analyzer, open the APK file or the installed app, and read the “Signature Certificate” section. The fingerprint should match the developer’s published fingerprint on their site or GitHub release notes.
Is sideloading safe with these apps?
Sideloading is as safe as the APK source and your verification habits. These apps help you verify. They cannot make a malicious APK safe. Stick to reputable sources (Aptoide, F-Droid, GitHub Releases from known developers) and check the signature before every install.
What does Google’s advanced sideloading flow change?
Google’s new flow ties developer identity to a verified account, which raises the cost of anonymous malware distribution. It does not verify individual APKs, so a legitimate developer whose account is compromised can still ship a bad build. Signature verification catches that.
Do I need root to use these apps?
No. All six apps work without root. App Manager unlocks additional depth on rooted devices, but the core signature and permission checks are unrooted.
