About

TigrinhoAPK publishes Android APK files together with the facts behind them, and says where each fact comes from. Size in bytes, the SHA-256 of the file and the signing certificate are read out of the file we host. Version, minimum Android version and the declared permissions come from F-Droid's package index, whose signature we verify against a pinned certificate before we use anything in it — we do not yet parse those fields out of the binary manifest ourselves.

What we check

The first time a package is added, we record the SHA-256 fingerprint of the certificate that signed it. Every later release of that same package is compared against that fingerprint. If it does not match, the file is not published — a different signature means whoever signed it changed, which is the strongest signal that an APK was repackaged.

Each app's page shows the SHA-256 of the file and of the signing certificate, so you can check for yourself what you downloaded.

What we do not check

We do not analyse what the app does. A signature check says the file comes from the same signer as before; it does not say the app is safe, or that it does what it claims. If a developer ships a malicious release signed with their own key, our check passes.

We also do not invent ratings or download counts. When we do not have that data, the page simply leaves it out — an absent field beats a made-up number.