For Android 7 and newer. Released 28 September 2026. Free and open source, GPL-3.0.
Alpha · not yet auditedKryfo works, and it is used every day. But no outside security firm has reviewed it yet, and it is young: features still land and things change between releases.
Not sure? Take arm64-v8a. If Android says the app is not compatible with your phone, take armeabi-v7a instead. x86_64 is for emulators and Chromebooks.
639810f70f8a8446c2490254c34cafac394e82227308bf09102d7715a3a21da48076405856d2c318f30d4b585374dd75627a326b62064772c0dc924ff75834f1378c4bc477f4129baafdf622d4babcb66548e73df75988d5c24ecc190e0535c5Every file here comes from kryfo.app itself, with no third party in between, and every link works in Tor Browser too. Android will warn you about installing outside the Play Store. That is expected: allow it for your browser or files app, then open the file again.
Two checks, and either one is enough to catch a changed file: the checksum of what you downloaded, and the key it was signed with.
On a computer, compare the SHA-256 of the file with the one printed above it.
# Linux sha256sum kryfo-0.4.2-arm64-v8a.apk # macOS shasum -a 256 kryfo-0.4.2-arm64-v8a.apk # Windows (PowerShell) Get-FileHash kryfo-0.4.2-arm64-v8a.apk
Every build of Kryfo is signed with the same key. Its fingerprint:
10:92:8A:61:64:2C:5C:C4:71:A9:98:69:E2:EA:4E:2D:4D:70:02:6E:79:7D:FB:A4:8C:0F:30:6B:5B:34:73:DBWith the Android build tools on a computer:
apksigner verify --print-certs kryfo-0.4.2-arm64-v8a.apk # Signer #1 certificate SHA-256 digest: # 10928a61642c5cc471a99869e2ea4e2d4d70026e797dfba48c0f306b5b3473db
On the phone, an app like AppVerifier shows the fingerprint of an installed app. After the first install, Android itself refuses any update that is not signed with the same key.
These three packages are the reproducible build of commit da6f1ac1: anyone can build them again from the source and get the same bytes, apart from the signature. F-Droid will sign its own builds with its own key, which is why a package from there will not match this fingerprint, and why it cannot update one installed from here.
And everything that came with 0.3.0:
The full list is in the changelog.
Obtainium is a free app that watches this page and installs new versions of Kryfo when they appear, straight from kryfo.app. No store, no account.
https://kryfo.app/download as the source URL. Or, on the phone, use the button below.arm64-v8a (or armeabi-v7a).F-Droid is on its way too: Kryfo is in review there, built from source on their machines, not ours.