How to Verify a Mod APK Download Yourself — Checksums, Permissions & File Checks

You don’t have to take anyone’s word for what an APK file is. With a few free tools and a careful eye, you can check a downloaded file yourself before installing it. This guide walks you through checksums, permissions, and file checks step by step — no technical background required. One fair warning up front: these checks reduce risk, but they cannot prove a file is safe. Nothing short of expert analysis can.

What is a checksum?

A checksum (also called a hash) is a short string of letters and numbers computed from a file’s contents — like a fingerprint for the file. Change even a single byte of the file, and the checksum comes out completely different.

SHA-256 is the most widely used checksum algorithm today. It produces a 64-character fingerprint. Publishers share a file’s SHA-256 hash so you can confirm that the file you downloaded is byte-for-byte identical to the file they published. If your computed hash matches theirs, the file wasn’t corrupted or altered in transit.

What SHA-256 can prove — and what it cannot

A matching hash proves	It does NOT prove
Your file is identical to the file the publisher hashed	That the file is safe, clean, or malware-free
The download wasn’t corrupted or altered on the way to you	That the publisher is trustworthy
A copy on a mirror matches the original	That the app will behave as advertised

Remember: a matching hash answers exactly one question — "Is this the same file?" It says nothing about whether that file is safe. A hash published by an untrustworthy source only proves the file matches what that source intended to give you — malware included.

How to calculate a SHA-256 hash

Step 1. Download the APK file, but do not install it yet.

Step 2. Compute its SHA-256 fingerprint:

On Android

Install a reputable hash-checker app from the Google Play Store, open it, select the downloaded APK file, and choose SHA-256. The app will display the 64-character hash — copy it.

On Windows

Windows has a built-in tool. Open Command Prompt and run:

certutil -hashfile "C:\path\to\file.apk" SHA256

Replace the path with the actual location of your downloaded file.

On macOS or Linux

Open Terminal and run:

shasum -a 256 /path/to/file.apk

Step 3. Compare your result with the reference hash character by character. Don’t just glance at the first few characters — compare the entire 64-character string. A single differing character means a different file.

The reference hash must come from a trustworthy source

This is the step most people get wrong. A checksum only proves your file matches the reference. If the reference hash is published on the same untrusted page as the download, a match proves nothing — anyone who replaced the file could simply replace the published hash too.

A reference hash is only meaningful when it comes from a source you trust independently of the download — for example, the developer’s own verified channel, or a release page you have separate reason to trust. If no independent reference exists, the hash check can’t confirm authenticity — but you can still use it to confirm that two copies of a file are identical, which is useful when comparing mirrors.

File size and version consistency checks

File size: compare the downloaded file’s size with the size published on the download page. A difference of more than a few kilobytes is a red flag — the same file should be the same size everywhere.
Version number: check that the version in the filename matches the published version. After installation, you can also confirm it in Settings → Apps → App info.
Filename: the downloaded filename should match what was advertised. A completely different name suggests you didn’t get the file you asked for.

Scan the file for malware

Antivirus scan: before installing, scan the APK with a reputable antivirus app on your device.
Multi-engine scanning: you can also upload the file to VirusTotal (virustotal.com) — a free service that scans uploads with dozens of antivirus engines and shows each engine’s verdict side by side.
Reading the results: one or two flags out of 60+ engines can be a false positive — modified apps often trigger heuristic detections simply because they’ve been repackaged. But multiple serious detections are a strong reason not to install.

No scanner catches everything, especially brand-new threats. A clean scan reduces risk; it doesn’t eliminate it.

Check the app’s permissions before and during install

Android shows you what an app wants access to. Read the list and ask of each permission: does a video editor need this?

Expected: storage / media access, and plausibly camera and microphone for a video app.
Red flags: SMS, call logs, contacts, background location, or device-admin rights. A video editor has no legitimate need for these.

After installation, review what’s granted in Settings → Apps → the app → Permissions, and revoke anything unnecessary. Modern Android also lets you grant sensitive permissions "only while using the app."

Package and app identity basics

Every Android app has a package name — a unique ID like com.alightcreative.motion (the official Alight Motion). Modified builds usually keep the same package name so they can replace the original app; that’s normal for mods, but it means the package name alone tells you nothing about safety.

What you can check after installing: in Settings → Apps → App info, the app name and icon should match the real Alight Motion. A mismatched name, a strange icon, or an unfamiliar second app appearing after install are warning signs — uninstall and investigate.

Verify the download source itself

Prefer pages that link directly to the file (for example, a release asset on GitHub) over redirect chains, URL shorteners, and "download managers."
Be wary of pages with multiple fake "Download" buttons, pop-ups, or countdown timers — those are designed to make you click the wrong thing.
Check that the site uses HTTPS and that the domain is the one you intended to visit. Lookalike domains are a common trick.

Signs the file may have been replaced

The SHA-256 hash doesn’t match the reference.
The file size differs noticeably from the published size.
The filename doesn’t match what was advertised.
The download involved unexpected redirects or dropped extra files.
The installer requests permissions the published description didn’t mention.

What to do when checks don’t match

Do not install the file.
Delete it from your device.
Download from a different source — and run the checks again.
If several sources disagree, treat the file as untrustworthy and skip it. No unlocked feature is worth a compromised device.

Checks are one layer — understand the bigger picture

Verifying a file is a valuable habit, but it’s only part of staying safe with unofficial apps. For the full picture — what mod APKs are, why they carry extra risk compared with the Play Store version, and how to protect your projects — read our companion guide: Is Alight Motion Mod APK Safe? Risks & How to Reduce Them.