Android App Security · Inside an APK · Lesson 3 of 5

Signing & Updates

Learn why every app is signed and how the signature decides who can update it.

The developer's seal

Android won't install an APK unless it has been signed. Signing means the developer runs the finished app through a tool that uses their private key, a secret file only they should have. The result is a digital signature attached to the APK, plus a certificate that carries the matching public key.

Your phone uses the public key to check the signature. If even one byte of the app changed after signing, the check fails and the install is refused. So the signature proves two things: the app hasn't been altered, and it was signed by whoever holds that private key.

Here's the part that surprises people. Android app certificates are usually self-signed. No authority checks that the name inside is true. Anyone can make a certificate that says "QuickNotes Ltd". What can't be copied is the key itself. That's why tools show a fingerprint, a short code calculated from the certificate, such as a SHA-256 value starting 3A:7F. Two different keys give two different fingerprints, whatever names they claim.

The signature is what makes updates safe. When an update arrives, Android compares its certificate with the one on the installed app. If they match, the update goes ahead and keeps all your data. If they don't, Android refuses it. A developer who signs with a different key has to publish under a new package name, and you'd get it as a separate app.

This makes the key precious. A developer who loses it, and doesn't use Google's key management (coming up next), can never update that app again. To make changing keys possible, Android 9 added key rotation. The developer signs a record saying "my old key hands over to this new one", and phones that understand the record accept updates signed with the new key.

Schemes, Play and repackaged apps

Android's signing method has been upgraded several times. Each version is called a signature scheme, and modern apps usually carry more than one so older phones can still check them.

• v1 is the original, borrowed from Java's JAR signing. Its files live in META-INF/. It doesn't protect every part of the ZIP file, which left room for tricks.
• v2 arrived in Android 7.0. It signs the whole APK file and stores the signature in a signing block inside it, so any change outside that block breaks the signature. Checking it is also faster.
• v3 arrived in Android 9. It works like v2 but adds the record that makes key rotation possible.
• v4 arrived in Android 11. It lives in a separate .idsig file and lets an app be checked while it's still streaming onto the phone. It always comes alongside a v2 or v3 signature.

On Google Play, most developers now use Play App Signing. Google keeps the real app signing key safe and signs the APKs your phone receives. The developer signs uploads with a separate upload key. If the upload key is lost or stolen, Google can reset it, and the app can still be updated. New apps on Play have needed this since August 2021, because app bundles leave the final APK building and signing to Play.

Now picture a repackaged app. Someone takes a real APK, unzips it, adds hidden ads or spyware, then signs it again with their own key. It keeps the same name, icon and often the same package name. It's shared on forums and download sites, often as a "free premium" version.

The new signature gives it away. If the real app is already on your phone, Android refuses to install the copy over it, because the certificates don't match. If you remove the real app first, the copy installs fine, and then real updates can't install over it. A different fingerprint for a familiar app name is one of the clearest warning signs there is.