How to verify a sideloaded WhatsApp-mod APK yourself
A practical walkthrough of the first-party tools — VirusTotal, Play Protect, apksigner, shasum — you can use to verify any sideloaded APK before you install it. No "we tested it for you" marketing.
An earlier version of this post described a four-stage internal "verification pipeline" we operated on every release — signature verification, 64-engine malware scan, sandbox traffic analysis, 47-device QA. None of that pipeline exists. The post has been rewritten as a practical guide to the first-party tools you can use to verify any sideloaded APK on your own end. The same checks apply to any APK from any mirror, ours included.
Editorial note
This post is part of a February 2026 site-wide cleanup. We have removed claims of internal verification work that we do not actually perform. See /about/ for the wider context.
Why first-party tools beat marketing claims
A download-mirror site claiming "we tested it ourselves" gives you exactly one thing: their assertion. There is no way for you to verify the assertion is accurate, current, or even a fact at all. First-party tools — VirusTotal, Play Protect, the Android signing toolchain — are independent, well-documented, and produce evidence you can re-run and re-check. That asymmetry is the entire point of doing verification on your end.
Step 1 — Scan the APK on VirusTotal
VirusTotal (run by Google) accepts file uploads up to 650 MB and runs each one through 60-plus anti-malware engines simultaneously. The report shows per-engine detections, behavioural analysis, network indicators, and the file's submission history. Critically: the URL is cached by the file's hash. Anyone scanning the same APK gets the same URL, so you can re-find a previous scan, share it with friends, or check whether the file you downloaded matches an earlier known-clean scan.
Open virustotal.com, drag the APK into the upload area, wait for the scan, read the result. Treat any non-zero detection from a reputable engine as a reason to delete the file and re-download from the developer's announcement.
Step 2 — Let Play Protect scan at install
Play Protect is Android's built-in malware scanner. It runs automatically on every APK install, sideloaded or not, on any phone with Google Play Services. Play Protect will pop up a warning for almost every sideloaded APK ("This app was not built for the Play Store") — that is normal and not proof of malware. But if Play Protect flags an APK with a stronger warning ("Harmful app detected"), abort the install and treat the file as suspect.
Step 3 — Verify the signing certificate
Every APK is signed with a developer keystore. The signing certificate is a fingerprint that identifies who built the file. Different builds from the same developer share a fingerprint; a repackaged or tampered APK does not.
On a desktop with the Android build tools installed, run:
apksigner verify --print-certs file.apk
The output includes the SHA-256 of the signing certificate. Compare it against the SHA-256 the developer publishes in their official release announcement. If they don't match, the file is not from the developer — delete it.
Step 4 — Compare the file hash
Independent of the signature, the developer typically publishes a SHA-256 of the APK file itself in each release announcement. Compute the same hash on your downloaded file:
- macOS / Linux: shasum -a 256 file.apk
- Windows: certutil -hashfile file.apk SHA256
- Android: install "Hash Checker" or similar from Play Store
If the hash on your phone matches the developer's announcement, the file traveled through the mirror unchanged. If it does not match, something modified the file in transit — delete and re-download.
What none of these checks tell you
These four checks tell you the file is what the developer published. They tell you nothing about whether running the developer's build is safe — that depends on what the developer chose to ship, which they may not fully disclose. If the developer secretly added a tracking library, all four checks will say "clean" because the secret library is part of the signed, hash-matched file. The only protection against that is the developer's reputation over time and the community's analysis of the running app's behaviour.
Honest baseline
A mirror site can give you a faster, less ad-laden access path to a file. It cannot give you a meaningful safety signal on the file itself. Always run the four checks above before installing — they take five minutes and they apply to any APK from any source.
Published · Word count: 701
Sources cited
First-party links — verify our claims against them, not just our restatement.
- 1 VirusTotal → Multi-engine malware aggregator run by Google.
- 2 Play Protect → Android's built-in scanning service.
- 3 apksigner (Android docs) → Official Android signing-toolchain documentation.
- 4 APK Signing Block v2 specification → How signing works at the file format level.
Last content update: · View change history
More from Security