Verify your copy

Applies to Android 1.0.0 and later

A signing fingerprint is the serial number of a digital seal only we can apply. If the APK you have carries the seal below, it came from us and hasn't been altered. Any mirror is just a copy — the signature is what makes it genuine.

Official fingerprints

Android APK signing certificate (SHA-256)02:AE:DC:63:FB:B7:79:3C:BA:5A:31:36:23:54:87:10:AA:E9:4A:C6:E7:8C:D3:AF:CA:D3:9B:16:6F:A5:70:06

Same fingerprint, lowercase without colons02aedc63fbb7793cba5a313623548710aae94ac6e78cd3afcad39b166fa57006

Config signing public key (Ed25519, 32 bytes)8c071da92b2b8fb9f4c373384a5cc4be531035ea20df3a64ce7a08a9c0ae1cec

Check an APK

Most people: download only from the links below, not from a link someone forwarded you.

Technical users: print the certificate with apksigner from the Android SDK. The SHA-256 digest must match the fingerprint above.

apksigner verify --print-certs chencang-1.0.0.apk

Each GitHub Release also lists the file's SHA-256, so you can compare a mirror's download byte for byte.

The update config

The app reads a public config file (it contains no personal or device information) that lists download mirrors and the latest version. It is signed with the key above, which is built into the app. The app checks the signature every time and discards anything that doesn't verify — you don't need to do anything.

Official downloads

GitHub Releases (the release source)
Latest APK, direct download

← Back to home