Android developer verification checker
Drop in your .apk to see its package name and signing key fingerprint, and whether Google has them on file. From September 30, 2026, testers in Brazil, Indonesia, Singapore and Thailandhit extra steps installing apps that aren't registered. Free, and your file is read right here in your browser.
Drop your .apk
or browse files. Any size works — we only read the signing key inside
Sign in once, then check as many builds as you like.
What developer verification changes
Until now, an Android phone would install an app from anywhere as long as the person tapped through a warning. Google is adding a step before that: it checks whether the app's developer is someone it knows. Being known means having registered two things — the app's package name and the SHA-256 fingerprint of the key it is signed with.
Apps that fail the check are not blocked. They get friction instead: more confirmation screens, and sometimes a wait. If you distribute beta builds, that friction lands on your testers, and some of them will not push through it. A tester who gives up at a scary dialog looks exactly like a tester who never opened your link.
None of this touches Google Play. If your app ships through the Play Store, the account you already pay for covers it. This is about every other way a build reaches a phone — an install link, an internal enterprise rollout, a download from your own site.
Now
Registration is open
Package names can be registered in Play Console or the Android Developer Console today. Doing it early costs nothing and takes the deadline off your list.
September 30, 2026
Verification starts in Brazil, Indonesia, Singapore and Thailand
People in those four countries installing an unregistered app from outside an app store start seeing extra steps. Everyone else is unaffected for now.
During 2027
It goes worldwide
The same check reaches all certified Android devices everywhere. At that point an unregistered package name means friction for every tester you have, not just those in the first four markets.
Your fingerprint, without keytool
Registering means pasting the SHA-256 of your signing certificate into Google's console. Most people have never seen that number and have to go hunting for their keystore to find it. This reads it straight out of the build.
Your build stays on your computer
The file is read in your browser tab. Only the package name and the fingerprint are sent, because only Google can answer whether that pair is registered. The APK itself never reaches us.
You get an answer in a second
No upload bar, no queue. We read the few kilobytes that hold the signing key and ask Google about them. A 500 MB build is as quick as a 5 MB one.
Checked against the real registry
The answer comes from Google's own Developer ID Status API, not from a guess about your project settings. It is the same record that decides what your testers see.
How to register
Registering is a form, not a code change — you are telling Google which package names are yours and which key signs them. The only awkward part is the fingerprint, which is what the checker above hands you.
If your app is on Google Play
Open Play Console and find the Android developer verification page. Your apps are listed with their status next to them, and the signing key is already on file from Play App Signing. There is usually nothing to pay and nothing to type.
If it isn't
Open the Android Developer Console and create an account — $25 once, waived for the Limited Distribution account if you ship to 20 devices or fewer. Add your package name under Package names, then paste in the SHA-256 fingerprint from the checker above.
If the package name already exists
Google will ask you to prove it is yours. It hands you a snippet to place in your app's assets folder, which you then sign with your key and upload — the same key check, done the long way round.
Finding the fingerprint from a terminal
Useful inside a build pipeline. Both tools ship with the Android SDK, and both print the same number the checker above reads.
# From the finished APK — what actually shipped:
apksigner verify --print-certs app-release.apk | grep SHA-256
# From the keystore — what you intend to ship with:
keytool -list -v -keystore release.jks -alias release | grep SHA256Google wants the fingerprint as plain lowercase hex without the colons these commands print between each byte.
Registered, and ready to send it out?
Upload the build to App Dropper and send your testers a link they can tap to install. Every Android build gets its registration status checked automatically, so you see it before they do.
Common questions
Tap a question to see the answer.
What is Android developer verification?
Google is starting to check who made an app before letting people install it from outside an app store. To pass, a developer registers two things with Google: their app's package name, and the SHA-256 fingerprint of the key they sign it with. Anything not on that list gets treated as coming from nobody in particular, and the person installing it has to work harder to get it onto their phone.
When does it start?
September 30, 2026 for people in Brazil, Indonesia, Singapore and Thailand. Everywhere else follows during 2027. Nothing changes for existing installs on the day — this affects new sideloaded installs, and only on certified devices running Android 7 or newer.
What actually happens to my testers if I don't register?
They can still install the build. Android adds friction rather than a wall: extra confirmation screens, and in some cases a wait before the install goes through. On its own that sounds minor, but a beta tester who came to try your app and hit an unexplained warning often just closes it. That is the real cost — not a block, a drop-off.
Do you upload my APK?
No. The file is read inside your browser tab, the same way our target API level checker works. Two short pieces of text leave the page — your package name and the 64-character fingerprint — because only Google can answer whether that pair is registered, and asking needs a key we can't put in a browser. Your build itself never reaches us, so its size doesn't matter and there is nothing for us to store or delete.
Where does the fingerprint come from?
Out of the APK itself. Every signed APK carries its signing certificate in a section called the APK Signing Block. We read that section, take the SHA-256 of the certificate, and show it. It is the same number apksigner prints, and the same one Google asks for when you register.
Can't I get the fingerprint from keytool?
You can, and if you have the keystore file and its password to hand, keytool -list -v is the standard way. This page is for the times you don't: checking a build somebody else produced, confirming what a CI pipeline actually signed with, or just not wanting to look up the incantation again. It reads the finished file rather than the keystore, which also means it shows what really went out, not what was supposed to.
Why does it say my package is registered to a different key?
The package name is registered, but against another certificate. Usually one of two things: your team rotated signing keys and this build predates the change, or the APK came from Google Play, which re-signs apps with its own key under Play App Signing. If neither fits, someone else has claimed the name, and that needs Google's help rather than another registration.
Should I check the .aab or the .apk?
The .apk. An app bundle is signed with your upload key, but Google re-signs the app it distributes with a key only Play holds, so the fingerprint inside a bundle isn't the one that ends up on anyone's phone. Drop in the APK your testers actually install. If you upload through Play, the fingerprint Google registers is the one in Play Console under App signing.
Does this apply to apps on Google Play?
Play apps are covered by the verification you already did as a Play developer, so publishing there is not the problem. This matters for everything that reaches a phone another way: beta builds sent to testers, internal enterprise apps, and downloads from your own site.
Is registering free?
If your app is on Google Play, it is covered by the account you already pay for. Otherwise the Android Developer Console charges a one-off $25 to open an account, the same as Play's registration fee, and waives it for the Limited Distribution account aimed at students and hobbyists shipping to 20 devices or fewer.
Google's own write-up is at developer.android.com/developer-verification. While you are checking builds, the target API level checker covers the other deadline Google Play enforces.