How to Verify Checksums of Sideloaded APKs on Android TV

Updated 2026-10-29

Why verification matters for sideloaded Android TV apps

Android TV devices often get configured for enterprise deployments or home-share setups where users install APK files not found in the Play Store. When an administrator pushes custom apps, or a user drags a file from a USB drive onto the receiver, there is no store review gate. Verifying the checksum of each sideloaded APK right after installation gives you confidence the binary matches its source and isn’t corrupted during transfer. Without verification, a misplaced file, a bad download, or a swap attack can quietly change which apps run on your living-room box.

Prepare the device and pull the installed APK list

Before testing any checksum, make sure the device has ADB debugging enabled over Wi‑Fi or a USB connection. On most Android TV models, enable Developer options, then turn on ADB debugging. If your box sits behind a router, connect a laptop directly via Ethernet or use a local network scan tool like adb ip to locate the device. Once connected, run adb shell pm list packages -all to capture the full inventory of installed apps.

The command shows package names and their install locations:

adb shell pm list packages -all

From that output identify the APKs you meant to sideload—especially those not on the main channel (e.g., marked as “package:” vs. “system”). Some bundled apps hide from the list; a grep over /data/app/com.android.package can reveal them on many builds, though the exact path varies by Android version.

Check the checksum of the APK with ADB and local tools

Once you have the APK’s path, pull it to the laptop with adb pull /data/app/<name>/main.apk ./. Then compute its SHA-256 digest with sha256sum main.apk. Compare that hash against the developer-provided checksum (the SHA-256 string printed in the release notes or signed package file).

If SHA-256 is not available, MBED or AppDistroyer provide MD5/SHA-1 equivalents, but always keep a record of which algorithm you used. Document the hash, the tool version, and the timestamp alongside the app name in a small table:

app: com.example.todo
sha256: a3f2b9c4...   tool: sha256sum v1.9
installed: 2024-03-15 10:22 UTC

This habit is what enterprise IT teams do before pushing any sideloaded software, and it works just as well on consumer Android TV boxes.

Built-in verification shortcuts and limitations

Some third-party launchers that support sideloading (such as Kodi or Helium) embed a small integrity check during setup. If you use the CleanYourTV launcher, it includes an option to validate signed APKs against a manifest you upload. Enable it in Settings > System > Safety, then select “Verify integrity on install.” When the launcher reports a mismatch, it typically means the binary differs from the expected signature, and you can re-download the original file.

Limitations remain. A checksum verifies that the downloaded bytes match the published archive at the time of signing. It does not protect against a legitimate app that gets updated on the device while you’re testing, because the post-update file has a new hash. For ongoing assurance, pin the exact release SHA-256 value for each approved build and reject anything different.

A practical checklist for every sideload

Follow this loop for each APK you bring to your Android TV:

• Confirm the SHA-256 (or MD5/SHA-1) hash of the file as it existed on the transfer medium.
• Pull the APK via ADB and recompute the hash locally.
• Reject the app if the local hash differs from the trusted source value.
• If the launcher supports it, run its built-in integrity check immediately after installation.
• Log every verified app in a shared document with date, hash, and hash source.

Using this routine, plus CleanYourTV’s verification toggle, turns sideloading from a blind risk into a controllable, auditable process. It catches corrupted downloads on first boot, flags any tampering before the app runs, and keeps your TV’s home environment secure without relying solely on the Play Store.

Related reading: more Android TV notes