Is my APK the real one?
Meshtrike spreads phone to phone, often without internet. That is exactly when a fake copy could be passed along. Pick the APK below and this page tells you in a few seconds whether it is genuine. It works on a phone or a computer.
Check an APK
Your file is checked on this device and never uploaded. This page cannot even make network requests.
How can a page know it’s real?
Every genuine Meshtrike and MeshGRID APK is signed with one private release key, a secret that only the Meshtrike team holds and that never goes online. Signing works like a wax seal that nobody else can copy:
- The signature. Inside every APK is a signature made with the release key over the exact contents of the file. Change a single byte and the signature no longer fits. This page re-checks that signature with the same maths Android uses.
- The fingerprint. The APK also carries the key’s public certificate. Its SHA-256 fingerprint is a unique 64-character ID, shown below. Anyone can make a valid signature with their own key, but only the Meshtrike key produces this fingerprint.
- Both must match. Valid signature + official fingerprint = real. A modified file breaks the signature; a re-signed fake shows a different fingerprint.
Every genuine copy, from any source, shows these exact values.
APK signing certificate (SHA-256), Meshtrike and MeshGRID:
AB:09:7B:F4:3C:9B:63:0F:06:67:02:E0:61:9A:60:43:05:13:6A:D2:D6:4B:AA:38:E7:62:2F:AF:17:09:AD:3E
OpenPGP release key fingerprint:
79E2 783E D581 74B7 3393 FE0F 79A5 F1F0 4F2D EA99
minisign public key:
RWSC18AkPYb7l9TWSVy8CzBHwL/ZqkM7aXeAqeLlLHhsKDeoAaiZ463t
The same values are in the whitepaper, in every GitHub release, in the project README and inside the app. A fake would have to change all of them at once.
Other ways to check
Inside Meshtrike
Settings → About & limits → Verify this app shows the fingerprint of the copy you are running and of MeshGRID. It is a quick check, but a fake copy could show a fake number there, so check the APK file itself on this page before installing.
On a computer: one command
In the folder with the APK, run verify.sh from the release (or from the source repository):
sh verify.sh meshtrike.apk meshgrid.apkIt prints REAL or NOT REAL for each file.
Advanced: check every layer by hand (like Tor Browser)
Download the APKs together with SHA256SUMS, SHA256SUMS.asc and SHA256SUMS.minisig from the release, into one folder.
1. The files are the ones that were signed
shasum -a 256 -c SHA256SUMSEvery line must end in OK.
2. The checksums were signed by Meshtrike (OpenPGP)
gpg --import meshtrike-release-openpgp.asc
gpg --verify SHA256SUMS.asc SHA256SUMSLook for Good signature from "Meshtrike Releases", and check the key fingerprint gpg prints against the one above. A warning that the key is “not certified” is normal.
3. A second, independent signature (minisign)
minisign -Vm SHA256SUMS -P <minisign public key above>It must say Signature and comment signature verified.
4. The APK is signed with the real key (Android build tools)
apksigner verify --print-certs meshtrike.apkThe certificate SHA-256 digest must equal the APK signing certificate above, with or without colons.
Optional: AppVerifier on a phone
The open-source AppVerifier app can also compare an installed app’s fingerprint with the one above.
Do not install it. Delete it and warn whoever gave it to you. A real update is always signed with the same key: Android itself refuses to update Meshtrike from an APK signed by anyone else, so an “update” that asks you to uninstall first is a red flag.
Only if a key is lost or stolen. Any change would be announced in all the places above at the same time, signed with the other release key. A new fingerprint that appears in only one place is a fake.