Skip to content
Download APK
Download APKv10.8.2 · 20.44 MB · Android 5.0+
Guides

How to Check an APK SHA-256 Checksum on Android, Windows and Mac

A checksum tells you whether the APK on your device is the exact file that was published. Here is how to calculate and compare it on every platform, and what it cannot tell you.

Written by pikashowsapp.org Editorial TeamPublished Updated 8 min read

APK SHA-256 checksum being compared character by character next to a signing certificate check

An APK SHA-256 checksum is a 64-character code calculated from every byte of a file. If the code you calculate matches the one the publisher lists, you have exactly the same file. If a single byte is different, the code changes completely.

Checking it takes under a minute on Windows, macOS, Linux or Android, and you do not need to install anything on a computer. This guide shows each method, then goes one step further and explains how to check who signed the APK.

A matching checksum confirms the file is unchanged. It does not confirm the app is safe, legal or made by the developer it claims to be.

01

What an APK SHA-256 Checksum Actually Is

Think of SHA-256 as a fingerprint for a file. You run the file through a standard mathematical function and get back a fixed-length string of letters (a to f) and numbers. The same file always produces the same fingerprint, on any computer or phone.

Three properties make it useful:

  • It is always 64 hexadecimal characters, whether the file is 2 KB or 2 GB.
  • Changing even one byte produces a completely different result.
  • It is not practical to build a different file that deliberately produces the same SHA-256 value.

Because of that, publishers list a checksum next to a download so you can confirm nothing went wrong between their server and your device.

APK file turning into a unique SHA-256 checksum fingerprint of 64 characters
02

What a Matching Checksum Proves, and What It Does Not

What it proves

  • The download finished and is not corrupted.
  • The file is byte-for-byte identical to the one the checksum was taken from.
  • Nobody swapped or modified the file after that checksum was published.

What it does not prove

  • That the app is free of malware or unwanted tracking.
  • That the original developer built or signed it.
  • That using the app is legal where you live.
  • That the checksum itself came from a trustworthy source.

In short, a checksum answers “is this the same file?”, not “is this a good file?”. For the second question you need the certificate check below, a malware scan and your own judgement about the source.

03

The Checksum for the Current PikaShow Release

If you are checking the latest PikaShow APK, these are the values we recorded for version 10.8.2 on 16 September 2026.

DetailValue
File namePikaShow-v10.8.2.apk
Version10.8.2 (versionCode 83)
Size21,434,649 bytes (20.44 MB)
SHA-256372dc5af73e2299ed4a65c0567a3a2ecb3ce6c7ce850d06f4d3c29faf3a4e0a6
Package namecom.offshore.pikachu
Certificate SHA-256F6:14:BF:F7:BC:30:2B:71:25:C5:85:FD:FA:48:D5:DA:9E:24:B5:2F:40:83:99:3F:91:72:F6:7D:3D:C8:BE:6C

The same file circulates on other sites as pikashow_latest_v94.apk. Renaming a file does not change its checksum, so the value above still applies if the bytes are identical.

04

Check SHA-256 on Windows with certutil or PowerShell

If you are wondering how to check SHA256 of APK files on a PC, Windows 10 and 11 already include two tools that calculate hashes. The certutil SHA256 command works in Command Prompt; Get-FileHash works in PowerShell. Use whichever you prefer.

  1. 1

    Open File Explorer, go to your Downloads folder and click the address bar.

  2. 2

    Type cmd and press Enter. A Command Prompt opens already inside that folder.

  3. 3

    Run: certutil -hashfile PikaShow-v10.8.2.apk SHA256

  4. 4

    Or, in PowerShell, run: Get-FileHash .\PikaShow-v10.8.2.apk -Algorithm SHA256

  5. 5

    Copy the 64-character result and compare it with the published value.

certutil prints the hash in lowercase, while Get-FileHash prints it in uppercase. Both are the same value. If the file name has spaces, put it in quotes.

05

Check SHA-256 on macOS and Linux

Both systems ship with a hashing command in the terminal, so there is nothing to download.

  1. 1

    Open Terminal (on a Mac, press Command + Space and type Terminal).

  2. 2

    Move to the folder with the file, for example: cd ~/Downloads

  3. 3

    On macOS, run: shasum -a 256 PikaShow-v10.8.2.apk

  4. 4

    On Linux, run: sha256sum PikaShow-v10.8.2.apk

  5. 5

    Compare the hash printed before the file name with the published checksum.

Tip: type the command, then drag the APK from Finder or your file manager into the Terminal window to paste its full path.

06

How to Check SHA256 of an APK on Android

This is handy when you downloaded the APK straight to your phone. For a SHA256 checksum, Android users can rely on Termux, a free terminal app that already includes sha256sum, so there are no extra packages to install.

  1. 1

    Install Termux and open it.

  2. 2

    Run termux-setup-storage and allow storage access when Android asks.

  3. 3

    Run: sha256sum ~/storage/downloads/PikaShow-v10.8.2.apk

  4. 4

    Wait a few seconds for the 64-character hash to appear.

  5. 5

    Compare it with the published checksum before you tap Install.

If you would rather not use a terminal, a file-hash app from the Play Store can do the same job. Choose one that works offline and does not ask for permissions beyond reading the file you pick.

07

Compare the Result Carefully

To verify APK checksum results properly, compare all 64 characters, not just the first and last few. Letter case does not matter: A and a mean the same thing in a hexadecimal hash.

  1. Paste both values into a notes app, one above the other.
  2. Remove any spaces, file names or line breaks around the hash.
  3. Use your text editor’s Find to search for the published value inside your result.
  4. In PowerShell you can let the computer compare: (Get-FileHash .\PikaShow-v10.8.2.apk).Hash -eq "372dc5af73e2299ed4a65c0567a3a2ecb3ce6c7ce850d06f4d3c29faf3a4e0a6" returns True on a match, because -eq ignores case.

Which method suits you:

MethodWhereInstall neededBest for
certutil -hashfileWindows Command PromptNoQuick checks on any Windows PC
Get-FileHashWindows PowerShellNoAutomatic comparison with -eq
shasum -a 256macOS TerminalNoMac users
sha256sumLinux terminal or TermuxTermux on AndroidChecking directly on a phone
File-hash appAndroidYesPeople who prefer tapping to typing
Two SHA-256 hashes lined up to verify an APK checksum, with Windows, Mac, Linux and Android icons
08

APK Signature Verification: Check the Signing Certificate

Every APK is signed with a certificate, and Android uses it to decide whether an update may replace an installed app. The certificate fingerprint stays the same across versions from the same signer, while the file checksum changes with every release.

Using apksigner or keytool

  • apksigner (Android SDK Build-Tools): apksigner verify --print-certs PikaShow-v10.8.2.apk
  • keytool (included with Java): keytool -printcert -jarfile PikaShow-v10.8.2.apk

Look for the certificate SHA-256 digest. apksigner prints it in lowercase without colons; keytool prints it in uppercase with colons. For PikaShow v10.8.2 it should read F6:14:BF:F7:BC:30:2B:71:25:C5:85:FD:FA:48:D5:DA:9E:24:B5:2F:40:83:99:3F:91:72:F6:7D:3D:C8:BE:6C. keytool only reads older v1 (JAR) signatures, so if it shows nothing, use apksigner.

This release uses a debug certificate

The current PikaShow file is signed with CN=Android Debug, O=Android, C=US, the generic development certificate, not a publisher certificate. A match therefore tells you it is the same signer as the file we checked, but it cannot identify the developer.

APK signature verification showing a signing certificate fingerprint being matched in a terminal
09

What a Mismatch Means and What to Do Next

If the checksum does not match

The file is not the one that was published. Most often the download stopped early, which you can spot because the size is also wrong. If the size is right but the hash still differs, the file may be a different build or a repackaged copy. Delete it, download again from the same source and recheck. Do not install a file that fails twice.

If the certificate does not match

Someone other than the original signer produced the file. That is typical of a modified or MOD build. Android will also refuse to install it over your existing app with an “App not installed” error, which is one reason people find PikaShow not opening after an update from a different site.

Extra step: search the hash on VirusTotal

  1. Go to virustotal.com and choose the Search tab.
  2. Paste the SHA-256 value and press Enter.
  3. If the file has been scanned before, you will see the results from many antivirus engines without uploading anything.
  4. If it says the item was not found, you can upload the APK yourself, knowing uploads can be shared with security researchers.

We have not run a VirusTotal scan on this release, so please treat any result as your own finding. Read which engines flagged it and why, rather than just the total.

10

Frequently Asked Questions

What is an APK SHA-256 checksum?

It is a 64-character fingerprint calculated from the APK’s bytes. If yours matches the published value, the file is identical to the one the publisher checked.

Does a matching checksum mean the APK is safe?

No. It only proves the file has not changed since the checksum was taken. Safety depends on what the app does, which a checksum cannot show.

What is the certutil SHA256 command?

In Command Prompt, run certutil -hashfile followed by the file name and SHA256, for example certutil -hashfile PikaShow-v10.8.2.apk SHA256.

Is the checksum case-sensitive?

No. Hexadecimal hashes can be shown in uppercase or lowercase and still be the same value. Compare all 64 characters, ignoring case.

Can I check a SHA-256 checksum on Android without a computer?

Yes. Termux includes sha256sum, or you can use a file-hash app. Both read the APK in your Downloads folder and print its hash.

Why do the checksum and the certificate fingerprint look different?

The checksum describes the whole file and changes with every release. The certificate fingerprint describes the signing key and stays the same for all versions from the same signer.

My checksum does not match. Can I still install the APK?

We would not. Download it again and recheck. If the hash still differs, the file is not the published version and could be modified.

11

Make Checking a Habit

Checking an APK SHA-256 checksum takes one command and less than a minute, and it catches broken downloads and swapped files before they reach your phone. Pair it with a certificate check when you update.

Just remember what a match means: the file is the same one that was published. Whether you should install it is a separate decision.

Download APKv10.8.2 · 20.44 MB · Android 5.0+SHA-256 372dc5af73e2299e…

Non-affiliation notice: This website is an independent informational resource and is not affiliated with, endorsed by or sponsored by PikaShow, Google, Android, Microsoft, Apple, Termux or VirusTotal.

Share this article

Share this article
Tags:#Checksum#APK Safety