App signing

App signing is a digital seal that proves who built an Android app and that it has not been changed since, and updates must carry the same seal.

App signing: App signing is the process by which a developer attaches a digital signature, made with a private key, to an Android app. The phone checks it at install and on every update. It proves the app has not been altered and that an update comes from the same maker.

A signature does not mean the app is good. It only says who stands behind it. A criminal can sign a malicious app with their own key. What the signature does give you is a way to detect tampering: if someone repackages a real app with spyware inside, the original maker's signature breaks and a proper update will not install over it.

This is also why a fake copy of a popular app cannot quietly replace the real one on your phone through the normal update process. When you install an app outside the store, look for the maker's name on its official website, compare it with what the phone shows, and keep every update within the same source you first used.

Tips

• Keep updating an app from the same source you installed it from.
• Be suspicious of a cracked or modded version of a paid app; its seal has been broken.
• Check the developer name in the Play Store before installing a banking or payment app.

Related terms