How we check files

State of the catalog

Measured: 2026-09-12 14:46 UTC. Refreshes automatically.

Pace

Files checked in the last week: 1021. Still unchecked: 197.

At this pace the queue clears in roughly 1 week.

What is actually done to a file

• On upload the file is parsed: SHA-256 is computed, the manifest is read, the signing certificate is extracted. All of it is printed in the listing.
• The file is looked up in VirusTotal by SHA-256. For XAPK and APKM the hash of the inner base.apk is used, not the container’s: a container has its own hash that VirusTotal has never seen.
• The answer comes in three kinds, and we do not merge them: engines saw the file and found nothing; engines found detections; the file is not in the VirusTotal database at all.
• A file with more detections than the threshold is not served, and the app is unpublished automatically, with no human in the loop.
• An unchecked file is not blocked: antivirus here is an extra signal, not an entry pass. The listing states plainly that no check has happened.

Why this does not take a single day

The project’s VirusTotal key is a free one: four requests per minute and five hundred per day. So the queue runs in the background in small batches with pauses, rather than being cleared in one sweep. Published listings go first — their files are the ones actually served to visitors.

The order inside the queue is random rather than top-of-the-list. A deterministic order against an exhausted quota would mean every next sweep picking the same files and the queue never moving — which is exactly what happened until it was fixed.

What this check does not prove

• A clean verdict is the absence of detections at the time of the lookup, not a safety guarantee. Engines may learn to recognise a new malicious build later.
• We do not perform manual behavioural analysis of apps, and we do not claim to.
• Single detections on APKs are routine: packers and ad SDKs get caught by heuristics. That is why the unpublish threshold is not one, and why the detection itself is shown in the listing.
• VirusTotal alone is not enough as the only argument. That is why the SHA-256 and the certificate fingerprint are printed alongside: the signature is the most reliable sign that a file was not swapped on the way.

What we know about you when you download

• No account is needed to download, and none can be created — the site has no sign-up.
• The download log stores a hash instead of your IP address. The hash is not irreversible, so we treat it as personal data and delete it on a schedule.
• The file link is temporary and signed: we have no permanent direct links into storage.