# How do you verify Tor browser on Android?

**URL:** https://discuss.privacyguides.net/t/how-do-you-verify-tor-browser-on-android/29094
**Category:** Questions
**Created:** 2025-07-14T07:21:17Z
**Posts:** 17

## Post 1 by @4al — 2025-07-14T07:21:18Z

I can download Tor from [torproject.org](http://torproject.org) just fine, and I can use it just fine. The site even shows signatures alongside the Android APKs.

What I don’t get is how you verify it. The Tor Project ([How can I verify Tor Browser's signature? | Tor Project | Support](https://support.torproject.org/en/tbb/how-to-verify-signature/)) tells you how to verify signatures on every OS offered except Android. I don’t see a hash, and I don’t know what to do with the signature file without Android instructions. How have others here done it?

I’m not using the Google Play Store.

---

## Post 2 by @anesomy — 2025-07-14T08:24:51Z

Hey 4al — good question,

Verifying APKs on Android manually is a bit trickier than on desktop. Download the APK and .asc signature file from [torproject.org](http://torproject.org) directly. On your **desktop/laptop** , install GPG (GnuPG) if you haven’t already. Import the Tor Browser signing key (linked on their site), then use GPG to verify the .asc file against the APK.

`gpg --verify tor-browser-xxx.apk.asc tor-browser-xxx.apk`

If the signature checks out and matches the key fingerprint from [torproject.org](http://torproject.org), then you can safely transfer the APK to your Android device via USB, SD card, etc., and install it. I know it’s weird that there’s no direct verification method _on_ Android, but verifying on desktop before sideloading is a solid workaround.

---

## Post 3 by @4al — 2025-07-15T18:03:50Z

Thank you very much for this information. It’s definitely a strange workaround. I would be curious to see if others at privacy guides have done more or less the same thing. Is it a bad idea, then, to get Tor through Obtainium? Is it normal for AppVerifier to not have it in its database?

---

## Post 4 by @anon63378630 — 2025-07-15T19:17:12Z

> [@4al](#):
>
> through Obtainium

Obtainium doesn’t do any verification.

FFUpdater does verify all apps it supports however.

AppVerifier doesn’t have Tor Browser: [AppVerifier/app/src/main/kotlin/dev/soupslurpr/appverifier/InternalVerificationInfoDatabase.kt at a5fb0bb45b4b13434fe6e3d4739aef46791dbd40 · soupslurpr/AppVerifier · GitHub](https://github.com/soupslurpr/AppVerifier/blob/a5fb0bb45b4b13434fe6e3d4739aef46791dbd40/app/src/main/kotlin/dev/soupslurpr/appverifier/InternalVerificationInfoDatabase.kt)

iirc the dev was being weird and not allowing apps to be added to it

---

## Post 5 by @jerm — 2025-07-15T20:50:21Z

Is it related to being “Firefox based”, he’s close to GOS community, so probably not there because it being less secure.

---

## Post 6 by @4al — 2025-07-16T02:41:17Z

I think that by through obtainium, I mean ‘hooking it up to’ obtainium? Where obtainium has it in its app list, and can check its updates. I am guessing the Tor app may be self updating, so it may not be necessary, so I was more wondering whether it was a good idea to ‘hook Tor up,’ or if the correct verification method-- which, from previous replies, seems to include transferring the APK file from desktop-- makes this unfeasible.

I should note that I am something of an amateur.

---

## Post 7 by @4al — 2025-07-16T02:47:44Z

I woud also like to ask around a final time before going ahead with James’ solution:

Is James’ way the agreed upon way to verify Android Tor? Has anyone here done it differently?

(Or does the privacy community generally avoid Tor on mobile for it being Gecko-based?)

---

## Post 8 by @beantaco — 2025-07-17T02:08:13Z

Termux ([homepage](https://termux.dev/), [Fdroid](https://f-droid.org/packages/com.termux/)) has a GnuPG package. It may be possible to use that to verify signatures but I haven’t tried it myself yet.

---

## Post 9 by @4al — 2025-07-19T07:49:54Z

Before I go forward with this method, if you’d be so inclined, I’d like to ask how you figured this out, and if there are any sources (especially official, but even if not) you’d be able to cite for this method. It seems like such a strange roundabout method (not your fault, you’re only the messenger) and I suppose it’s just for curiosity and peace of mind’s sake to see if anyone else/how many other users use it.

---

## Post 10 by @4al — 2025-07-19T07:52:48Z

(Off-topic, but I apologize for replying to you so many times before, when only one of the replies was meant for you. I don’t really know how replying to multiple different people works within replies written through email.)

---

## Post 11 by @beantaco — 2025-07-25T06:08:49Z

I tried GnuPG on Termux.

```
pkg install gnupg
gpg --import TOR_BROWSER_PGP_KEY
gpg --verify APK_SIG APK
```

---

## Post 12 by @anon64387538 — 2026-02-27T00:54:18Z

Is someone who direct downloaded the . apk willing to post their AppVerifier hash for Tor Browser? (I think the hash will be different if you downloaded it from the Play Store.)

---

## Post 13 by @hashcatHitman — 2026-02-27T01:18:03Z

```
org.torproject.torbrowser
20:06:1F:04:5E:73:7C:67:37:5C:17:79:4C:FE:DB:43:6A:03:CE:C6:BA:CB:7C:B9:F9:66:42:20:5C:A2:CE:C8
```

See also this [thread on the GrapheneOS Forum: Let’s compare hashes for apps not in AppVerifier’s database!](https://discuss.grapheneos.org/d/15368-lets-compare-hashes-for-apps-not-in-appverifiers-database/18).

---

## Post 14 by @4al — 2026-08-10T19:54:07Z

Thank you guys very much for this!

---

## Post 15 by @anon67953901 — 2026-08-10T21:22:11Z

You can use AppVerifier app from Privacyguides to verify all your apps.

---

## Post 16 by @4al — 2026-08-10T22:10:50Z

Yes, I’m glad it exists! No one told me the original Appverifier was abandoned. I wonder what happened.

---

## Post 17 by @hashcatHitman — 2026-08-11T13:45:40Z

I’m not sure that abandoned is the right word. As far as I know, soupslurpr is still willing to fix bugs in AppVerifier. The last commit was a little over a year ago at this point, but as recently as a little over two weeks ago, they were still [adding labels to issue reports](https://github.com/soupslurpr/AppVerifier/issues/243#event-28466781619). The thing that everyone gets confused/upset about is that AppVerifier is not accepting any new apps into the internal database. See below:

> [@Rewrite Obtaining Applications: Recommend F-Droid over Obtainium and the Aurora Store](https://discuss.privacyguides.net/t/rewrite-obtaining-applications-recommend-f-droid-over-obtainium-and-the-aurora-store/29820/35):
>
> It isn’t very obviously documented, but [soupslurpr has said this is because it is too difficult to maintain](https://github.com/soupslurpr/AppVerifier/issues/192#issuecomment-2593784632). I’ve considered forking and trying to maintain the database myself, but I am not yet very knowledgeable in Kotlin or the finer details of Android, so I wouldn’t be able to do anything more complicated than maintaining simple hashes and simple fixes. It can still be used to compare with other people, or with other versions of an APK. (ie, if the APK is published on a developer-owned webs…