Check the signing certificate
Every Android app is signed, and the signature is what ties the app on your phone to whoever published it. Below is the SHA-256 fingerprint of the certificate Calcy Electric is signed with. If the app on your phone reports the same fingerprint, it came from us and nobody has repackaged it. If it reports a different one, uninstall it and install again from Google Play.
Why not a file hash
Publishing the SHA-256 of an APK file would not help you here. Calcy uses Play App Signing, so Google holds the signing key, re-signs the app, and builds a different set of files for each device — your phone's screen density, architecture and Android version all change which pieces it downloads. A hash of our upload would therefore never match the file that ends up on your phone, and any page claiming otherwise is checking the wrong thing. The certificate fingerprint is stable across every build and every device, which is why it is the thing worth publishing.
Fingerprint
- App signing key certificate
-
SHA-256
published at launch · Christmas 2026SHA-1
published at launch · Christmas 2026
Checking the app on your phone
On the phone. Any app-info or package-inspector tool that lists an app's signature will show you the certificate's SHA-256 digest. Open the entry for ch.calcy.electric and compare it with the fingerprint above, character for character.
With the Android SDK. apksigner ships with the SDK build-tools and prints the signer's certificate digests. Pull the installed app from a connected phone, then read its certificate:
adb shell pm path ch.calcy.electric
adb pull /data/app/.../base.apk calcy.apk
apksigner verify --print-certs calcy.apk
Use the path the first command printed in place of the one above. Look for the line reading Signer #1 certificate SHA-256 digest: — that is the value to compare. If the app arrived as several split files, they all carry the same signature, so base.apk is enough.
With a JDK instead. keytool reads the same certificate without the Android SDK:
keytool -printcert -jarfile calcy.apk
What a matching fingerprint does and does not tell you
A match means the app on your phone was signed with our key: the code is ours, unmodified since it was signed. Android enforces this too — it will refuse an update signed with any other key, which is what stops a repackaged build from replacing a real one. What the fingerprint cannot tell you is whether a given version behaves itself; for that, the calculation core is on GitHub to read, and every result in the app opens its own working.
Contact
A fingerprint doesn't match, or this page is out of date? officialplaystoredeveloper@gmail.com
Made with ❤️ + ☕ by humans. No AI.