All downloads

Android APK

Version 1.2.6 (build 10): Restores installation and updates for Android devices with earlier Whenary releases.

Download APK

Signed with our release certificate. Installs receive updates automatically via an in-app prompt.

If Android says “App not installed”

An existing Whenary installation in another Android user profile can still determine which signing certificate this device accepts. Keep that installation and its local data while checking the cause. This download uses the production certificate shown below. If installation still fails, the exact package installer error from ADB can identify the conflict.

adb install -r whenary-1.2.6.apk

If ADB reports INSTALL_FAILED_UPDATE_INCOMPATIBLE, the installed app and this release have different signing keys. Android cannot replace it while that older app is installed in any profile.

  1. Check every Android profile where Whenary is installed, including other users and work profiles.
  2. In each profile, save any data you need from Settings → Data → Export. If you use the encrypted vault, save its recovery phrase from Settings → Encryption. Confirm you can access those backups before uninstalling; data kept only on that device may be lost.
  3. Remove the older Whenary app from each affected profile, then install this release and sign in.

There is no need to delete an Android profile.

Verify integrity: SHA-256 checksum

The fastest check. Confirms the file was not corrupted or tampered with in transit.

3d7fd6c9506f4cb81a141c2fdf0e5a5632dcf379232c784faa171c95ab0181a0

sha256sum whenary-1.2.6.apk
# expected: 3d7fd6c9506f4cb81a141c2fdf0e5a5632dcf379232c784faa171c95ab0181a0

On macOS use shasum -a 256 instead of sha256sum.

Verify authenticity: APK signing certificate

Android enforces that all updates are signed with the same key as the original install. You can independently verify the certificate fingerprint matches the one published here.

Expected SHA-256 certificate fingerprint:

9E:68:2A:47:B2:A8:36:67:D0:0F:81:55:B9:A5:64:6F:AF:62:A7:4B:D7:0D:2E:51:9F:38:74:3F:0D:44:12:E9

# Requires Android SDK build-tools (apksigner):
apksigner verify --print-certs whenary-1.2.6.apk

# Or with keytool (JDK):
keytool -printcert -jarfile whenary-1.2.6.apk

# Or via ADB on a connected device with the app installed:
adb shell pm dump com.whenary.app | grep -A3 "Signatures"

On Android 9+ you can also check Settings → Apps → Whenary → App details on some ROMs.

Verify signature: Minisign (recommended)

Minisign uses Ed25519 to sign the APK. No key management overhead: just install the tool and verify with the public key below.

Public key:

RWQZyE41by8JAA8/x6cec7gU7a5xVo0QPXW8uOYf5fb45qkGVru7Uylb

# Install: https://jedisct1.github.io/minisign/
# Download the .minisig alongside the APK, then:
minisign -V -P RWQZyE41by8JAA8/x6cec7gU7a5xVo0QPXW8uOYf5fb45qkGVru7Uylb -m whenary-1.2.6.apk

# Or with a saved .pub file:
curl -O https://whenary.com/whenary-releases.pub
minisign -V -p whenary-releases.pub -m whenary-1.2.6.apk

The .minisig file is available at https://dl.whenary.com/android/whenary-1.2.6.apk.minisig

Verify signature: GPG / PGP

For users already in the GPG ecosystem. The APK is signed with the Whenary releases key.

# Import the signing key:
gpg --keyserver keys.openpgp.org --recv-keys 7C83207DD1A22E53

# Download the .asc signature alongside the APK, then:
gpg --verify whenary-1.2.6.apk.asc whenary-1.2.6.apk

The .asc file is available at https://dl.whenary.com/android/whenary-1.2.6.apk.asc

Verify signature: Sigstore / cosign

For supply-chain security tooling. The APK is signed with a cosign key pair. The bundle includes the message digest and Ed25519 signature.

# Install cosign: https://docs.sigstore.dev/cosign/system_config/installation/
# Download the .sigstore.json bundle alongside the APK, then:
cosign verify-blob \
  --key https://whenary.com/cosign.pub \
  --bundle whenary-1.2.6.apk.sigstore.json \
  --insecure-ignore-tlog \
  whenary-1.2.6.apk

The bundle is available at https://dl.whenary.com/android/whenary-1.2.6.apk.sigstore.json

Key trust & rotation

The Android update signing key is available to the release workflow through protected CI secrets. The separate APK verification keys are used for release signing. If a key is compromised or rotated, notice will be published at whenary.com/security and in the app release notes. An APK signed with a different certificate cannot update an existing install unless Android accepts a supported signing-key rotation.

Minisign / cosign keys are Ed25519, compact, fast, and resistant to implementation attacks.
The expected Android certificate fingerprint is published above so you can compare it with the downloaded APK.
Auto-update downloads are verified with SHA-256 before the install prompt appears.
Android app · Whenary