1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
|
+++
title = "Install"
date = 2026-11-05T00:00:00Z
description = "How to download the HardenedPass APK from GitHub Releases, verify its checksum and signing certificate, install it and update it."
weight = 20
draft = false
+++
HardenedPass needs Android 12 or newer and works without Google Play Services. It is
not on an app store: you install the APK from the project's releases.
## Download
Open the [latest release](https://github.com/danixland/HardenedPass/releases/latest)
and download both files:
- `HardenedPass_vX.Y.Z.apk`, the app
- `HardenedPass_vX.Y.Z.apk.sha256`, its checksum
## Verify the download
This step needs a computer, and it is worth doing: a password manager is a bad thing
to install from a tampered file.
Check that the file arrived intact:
```bash
sha256sum -c HardenedPass_vX.Y.Z.apk.sha256
```
The output must end in `OK`.
Then check who signed it. `apksigner` is part of the Android SDK build tools:
```bash
apksigner verify --print-certs HardenedPass_vX.Y.Z.apk
```
The `certificate SHA-256 digest` line must read:
```
725016669e482f9ac371dee8df19a2a1b34fa76d1af05b2a23784725b1b49c83
```
If either check fails, do not install the file.
## Install
Copy the APK to the phone and open it from the file manager. Android asks you to allow
installs from that app the first time. Allow it, install, then turn the permission off
again if you prefer.
HardenedPass has its own application ID, so it installs next to Android Password Store
instead of replacing it. The two share no data: to move over, set HardenedPass up
as described in [Connect the app]({{< relref "/hardenedpass/getting-started/connect" >}}).
## Update
The app does not check for updates. To follow new versions, watch the
[releases page](https://github.com/danixland/HardenedPass/releases) or its
[Atom feed](https://github.com/danixland/HardenedPass/releases.atom).
To update, verify the new APK the same way and install it over the old one. Your store
and keys stay in place. Android refuses an update signed with a different key, which
is one more check on top of yours.
|
