Download

Kryfo 0.4.2

For Android 7 and newer. Released 28 September 2026. Free and open source, GPL-3.0.

Alpha · not yet audited

Kryfo works, and it is used every day. But no outside security firm has reviewed it yet, and it is young: features still land and things change between releases.

01 · Which one do I need?

Almost everyone: arm64-v8a.

Not sure? Take arm64-v8a. If Android says the app is not compatible with your phone, take armeabi-v7a instead. x86_64 is for emulators and Chromebooks.

Almost every phone
arm64-v8a
kryfo-0.4.2-arm64-v8a.apk · 56.9 MB
SHA-256 of the file639810f70f8a8446c2490254c34cafac394e82227308bf09102d7715a3a21da4
Older phones
armeabi-v7a
kryfo-0.4.2-armeabi-v7a.apk · 52.0 MB
SHA-256 of the file8076405856d2c318f30d4b585374dd75627a326b62064772c0dc924ff75834f1
Emulators, Chromebooks
x86_64
kryfo-0.4.2-x86_64.apk · 59.9 MB
SHA-256 of the file378c4bc477f4129baafdf622d4babcb66548e73df75988d5c24ecc190e0535c5

Every file here comes from kryfo.app itself, with no third party in between, and every link works in Tor Browser too. Android will warn you about installing outside the Play Store. That is expected: allow it for your browser or files app, then open the file again.

02 · Check it

Make sure it is really ours.

Two checks, and either one is enough to catch a changed file: the checksum of what you downloaded, and the key it was signed with.

The checksum

On a computer, compare the SHA-256 of the file with the one printed above it.

# Linux
sha256sum kryfo-0.4.2-arm64-v8a.apk
# macOS
shasum -a 256 kryfo-0.4.2-arm64-v8a.apk
# Windows (PowerShell)
Get-FileHash kryfo-0.4.2-arm64-v8a.apk

The signing key

Every build of Kryfo is signed with the same key. Its fingerprint:

SHA-256 signing fingerprint 10:92:8A:61:64:2C:5C:C4:71:A9:98:69:E2:EA:4E:2D:4D:70:02:6E:79:7D:FB:A4:8C:0F:30:6B:5B:34:73:DB

With the Android build tools on a computer:

apksigner verify --print-certs kryfo-0.4.2-arm64-v8a.apk
# Signer #1 certificate SHA-256 digest:
# 10928a61642c5cc471a99869e2ea4e2d4d70026e797dfba48c0f306b5b3473db

On the phone, an app like AppVerifier shows the fingerprint of an installed app. After the first install, Android itself refuses any update that is not signed with the same key.

These three packages are the reproducible build of commit da6f1ac1: anyone can build them again from the source and get the same bytes, apart from the signature. F-Droid will sign its own builds with its own key, which is why a package from there will not match this fingerprint, and why it cannot update one installed from here.

03 · What's new

Ask together, find anything.

And everything that came with 0.3.0:

The full list is in the changelog.

04 · Updates

New versions, on their own.

Obtainium is a free app that watches this page and installs new versions of Kryfo when they appear, straight from kryfo.app. No store, no account.

  1. Install Obtainium from obtainium.imranr.dev or from F-Droid.
  2. Tap Add app and paste https://kryfo.app/download as the source URL. Or, on the phone, use the button below.
  3. When it asks which file, pick the one for your phone: arm64-v8a for almost everyone. To have it pick for you, set the APK filter to arm64-v8a (or armeabi-v7a).
  4. Install. From then on Obtainium checks this page and offers each new version. Android only accepts it if it is signed with the same key as the one you have.

F-Droid is on its way too: Kryfo is in review there, built from source on their machines, not ours.