Check a download

Beta versions of our apps are downloaded from each app's website rather than Google Play. Use these values to make sure a file came from us and was not changed.

Pocketful

Package name: com.onelifestack.pocketful
Beta signing certificate (SHA-256): 80:46:E3:44:2C:D9:17:4D:50:E3:AE:7F:54:6E:4E:2F:D7:20:7D:12:09:82:E4:E4:DE:FB:80:A4:DB:57:DF:5E
Current beta file: pocketful-0.9.0-beta.6.apk, released 2026-11-01
File checksum (SHA-256): 82e1901d2484181cb2b63b3d35fa1b199cbdb1f06529213fec6fb1617eea70b9

Lots

Package name: com.onelifestack.lots
Beta signing certificate (SHA-256): 9D:8C:A9:CB:76:65:39:5F:35:61:BC:F3:BF:11:5B:02:D4:03:04:67:4C:CC:4F:71:F7:DF:2C:0A:57:C6:2D:69
Current beta file: lots-0.9.0-beta.1.apk, released 2026-11-01
File checksum (SHA-256): 420cb1661dae6eb29f2d2bd11a70eef178e4ea81bad0d31c3080f39e11b5f1cf

How to check

The file. On a computer, run sha256sum file.apk (Linux), shasum -a 256 file.apk (macOS) or certutil -hashfile file.apk SHA256 (Windows). The result must match the checksum above.

The signature. With the Android SDK, run apksigner verify --print-certs file.apk. The certificate SHA-256 digest must match the one above. Any later beta of the same app is signed with the same certificate, so Android will only install an update that came from us.

Google Play builds are signed by Google Play app signing with a different key from the betas. Android will not install a Play build over a beta, or a beta over a Play build. Export a backup in the app, uninstall it, install the other build, then import your backup.