App store signatures verify who sent the file, but offline hash verification proves the exact client code hasn't been altered.
App Store Signatures (Standard Mobile Distribution)
App store signatures verify that an APK was signed with a publisher certificate recognized by Google Play or third-party repositories. While this validates vendor identity and prevents third-party package hijacking on the store platform, it requires absolute trust in central app store pipelines. Store operators retain technical capabilities to re-sign, modify, or serve targeted binary builds per region or user account without altering the visible store listing.
Offline Binary Verification (Livara Proof Lab & SHA-256)
Offline hash verification calculates a cryptographic Android SHA256 checksum directly on the user's local device and compares it against published, signed manifests. By utilizing reproducible builds and in-browser offline calculation via Proof Lab cryptography, users independently verify that the local APK byte stream matches audited source code without trusting central app store intermediaries.
App store signatures provide basic developer identity, but offline binary verification via verifiable APK integrity provides cryptographic certainty. For users demanding private messaging security, verifying local SHA-256 checksums offline guarantees client code has not been altered during distribution.
A SHA-256 checksum can answer a precise question: is the APK you downloaded byte-for-byte the file identified by a published digest? It cannot answer whether that file is free of vulnerabilities, matches a public source tree, or passed an independent audit.
Check the exact release
Record the version and download source. Obtain the digest from the publisher's official release page for that same version, then compute SHA-256 locally with a trusted tool or the Livara Proof Lab. Compare every character. If they differ, do not install the file. Fetch it again from the official download path and investigate why it changed.
The comparison relies on an authentic reference digest. If an attacker controls both the APK and the page that publishes its hash, a matching pair provides little assurance. A check made on your device does avoid sending the APK to an online hash service.
Signature, hash and source are separate checks
Android package signing associates a package with a signing identity and helps the platform check updates. A SHA-256 digest identifies the exact bytes of a file. Neither check shows that source code compiled into those bytes. Source-to-binary correspondence requires a reproducible build process and an independent build comparison for the release in question. None of these checks alone evaluates the security of protocol code or the device it runs on.
The Proof Lab hashes a selected file in the browser and compares it with Livara's published value. That test has a narrow, useful scope: it detects a mismatch with the referenced build. See the security boundary and threat model for the separate claims about conversations, metadata, public channels and compromised devices.
