October DealsAmazon USOctober deal check: compare before you payAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PCOctober DealsAmazon USDeal season is back - check today's better picksAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
Mountain View desk6 min

What Android Security State Libraries Verify—and What They Don’t

Play Integrity and key attestation provide evidence about specific app, device, and key properties—not a universal Android security certificate.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Android security-state checks provide evidence about specific things—not a universal certificate that a phone, app, user, or transaction is safe. Google Play Integrity can report whether Google recognizes an app, whether it has Play entitlement, and whether a device meets particular integrity criteria. Android key attestation instead provides evidence about a key pair and its attestation chain. Both can inform a server’s risk decision, but neither is a complete security audit.

What Play Integrity actually checks

Play Integrity returns verdicts for a request that an app sends to Google and that the app’s backend can evaluate. Its principal verdicts concern app recognition, Google Play entitlement, and device integrity. Optional checks can add other environment or abuse signals when the app is configured and eligible to receive them.

As an Amazon Associate I earn from qualifying purchases.

App recognition: appIntegrity

  • PLAY_RECOGNIZED means the app’s package name and signing certificate match a version distributed by Google Play. It does not certify that the app’s code is secure or that its behavior is benign.
  • UNRECOGNIZED_VERSION means the certificate or package name does not match Google Play’s records.
  • UNEVALUATED means a prerequisite for evaluating the verdict was not met.

Play entitlement: appLicensingVerdict

LICENSED indicates a Google Play entitlement, such as having downloaded or updated the app through Google Play. UNLICENSED can indicate that the app was sideloaded or that the user lacks Play entitlement. UNEVALUATED means the check could not be completed because a prerequisite was missing. This is an install-channel and entitlement signal, not proof of a person’s identity or a general fraud judgment. Google also documents a caveat for some older devices: a user may remain licensed after uninstalling the app and later obtaining the same app elsewhere.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Device integrity: deviceRecognitionVerdict

The device verdict can contain one or more labels, or no label if the evaluation criteria are not met. MEETS_DEVICE_INTEGRITY indicates a genuine, certified Android device. For Android 13 and later, Google describes this as including hardware-backed proof that the bootloader is locked and the loaded operating system is a certified manufacturer image.

#1 Best Overall
Sale
Samsung Galaxy A17 5G Smart Phone 128GB US 1 Yr Manufacturer Warranty Black | Large AMOLED, High-Res Camera, Durable Design, Super Fast Charging, Expandable Storage, Circle to Search, 2025
  • YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
  • LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
  • MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
  • NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
  • BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.

An absent label does not identify a single cause. It may reflect signs of attack, such as hooking or root, an emulator that fails the checks, or another evaluation condition. Treat it as an uncertain or unmet signal to investigate in context, not a diagnosis of exactly what is wrong.

Optional device labels

  • MEETS_BASIC_INTEGRITY is a weaker baseline. Its criteria can allow a locked or unlocked bootloader and a verified or unverified boot state.
  • MEETS_STRONG_INTEGRITY has different meanings by Android version. On Android 13 and later, Google requires a recent security update across all partitions, including OS and vendor patches; the update must be from within the last year. On Android 12 and earlier, the label relies on hardware-backed boot-integrity proof and does not itself require a recent patch.

Check the device’s Android version before interpreting the strong label. On Android 13 and later, these optional labels are returned only for a licensed app.

Rank #2
Tracfone Motorola Moto G 2025, 64GB, Saphire Blue (Locked to
  • Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Tracfone plan required, activating is easy, just 3 steps.
  • DISPLAY: Immersive viewing on a 6.7-inch super-bright 120Hz display with powerful stereo speakers and Bass Boost for cinematic entertainment.
  • CAMERA SYSTEM: Advanced 50MP Quad Pixel camera captures sharp, detailed photos and videos in any lighting condition
  • PERFORMANCE: Lightning-fast 5G connectivity paired with a powerful processor and RAM Boost for smooth multitasking.
  • BATTERY LIFE: Long-lasting 5000mAh battery with TurboPower charging technology delivers hours of power in minutes.

Optional environment and abuse signals

  • App access risk can identify other apps with permissions that could capture the screen, draw overlays, or control the device.
  • Play Protect can indicate protection state and the presence of known risky apps.
  • Recent device activity provides approximate levels of integrity-token request volume for an app.
  • Device recall (beta) can return app-defined device flags across reinstall or reset.

These signals require configuration and can be unavailable when prerequisites are not met. They are not automatically present in every app’s response.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What Android key attestation verifies

Key attestation can support a claim that a key pair used by an app is held in a hardware-backed keystore, along with other properties encoded in the attestation data. It is evidence about that key and its certificate chain—not a comprehensive statement about the entire phone, operating system, app, or user activity.

Rank #3
Sale
Samsung Galaxy A17 5G Smart Phone 128GB, US 1 Yr Manufacturer Warranty Blue | Large AMOLED, High-Res Camera, Durable Design, Super Fast Charging, Expandable Storage, Circle to Search, 2025
  • YOUR CONTENT, SUPER SMOOTH: The ultra-clear 6.7" FHD+ Super AMOLED display of Galaxy A17 5G helps bring your content to life, whether you're scrolling through recipes or video chatting with loved ones.¹
  • LIVE FAST. CHARGE FASTER: Focus more on the moment and less on your battery percentage with Galaxy A17 5G. Super Fast Charging powers up your battery so you can get back to life sooner.²
  • MEMORIES MADE PICTURE PERFECT: Capture every angle in stunning clarity, from wide family photos to close-ups of friends, with the triple-lens camera on Galaxy A17 5G.
  • NEED MORE STORAGE? WE HAVE YOU COVERED: With an improved 2TB of expandable storage, Galaxy A17 5G makes it easy to keep cherished photos, videos and important files readily accessible whenever you need them.³
  • BUILT TO LAST: With an improved IP54 rating, Galaxy A17 5G is even more durable than before.⁴ It’s built to resist splashes and dust and comes with a stronger yet slimmer Gorilla Glass Victus front and Glass Fiber Reinforced Polymer back.

Google’s validation guidance calls for sending the certificate chain to a separate trusted server rather than validating it on a potentially compromised device. The relying party should verify certificate signatures and the trust anchor, check certificate revocation, and inspect the attestation extension. Only the first occurrence of the key-attestation extension in a chain should be trusted. A chain that has not been validated this way is not a sound basis for relying on the encoded claims.

Play Integrity and key attestation compared

Question Play Integrity API Android key attestation
What is assessed? App recognition, Play entitlement, device integrity, and configured optional environment or risk signals. Properties of an app-used key and its attestation certificate chain.
Who interprets the evidence? Google returns verdicts; the app’s backend checks request binding and applies its policy. The relying party validates the chain, trust anchor, revocation status, and attestation extension, typically on a server.
Main scope limitation Labels depend on Android version, Play state, configuration, and evaluation prerequisites. Evidence is key-scoped and depends on hardware support and trustworthy chain validation.
Useful framing A risk signal for protected actions, not an all-clear. Evidence for key properties, not an all-device security score.

These mechanisms also do not cover every device-posture question. Android Enterprise lists checks such as operating-system security patch level, encryption, management state, screen-lock quality, and developer-options state separately from Play Integrity. A system that needs those facts must account for them explicitly rather than assuming an integrity verdict supplies them.

Rank #4
Sale
Samsung Galaxy S26 Ultra, Unlocked Android Smartphone, 512GB, Black | Privacy Display, Galaxy AI, AI Camera, Super Fast Charging 3.0, Durable Battery, 2026, US 1 Year Warranty
  • PRIVACY DISPLAY: Automatically hide your screen from those beside you. The built-in privacy display can be preset¹ to turn on when receiving notifications, typing passwords, or using specific apps
  • TYPE IT IN. TRANSFORM IT FAST: Enhance any shot in seconds on your smartphone by using Photo Assist² with Galaxy AI.³ Add objects, restore details, or apply new styles by simply typing or tapping
  • NIGHTS, CAPTURED CLEARLY: From gigs to city lights, record and capture moments after dark with clarity using Nightography so your photos and videos stay crisp and clear on your Samsung Galaxy
  • MAKE IT. EDIT IT. SHARE IT: Turn everyday moments into something personal with creative tools built right into your mobile phone, whether it’s a special contact photo, custom wallpaper, an invitation or more⁴
  • HELP THAT KEEPS UP: Stay in the moment while Now Nudge with Galaxy AI helps you respond faster and stay organized with smart suggestions⁵ that appear exactly when you need them on your phone
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

How a backend should use integrity results

Google says: “The Play Integrity API works best when used alongside other signals as part of your overall anti-abuse strategy and not as your sole anti-abuse mechanism.” In practice, a verdict is an input to policy, not an automatic allow-or-deny answer.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  1. Bind the verdict to the action. For standard requests, use requestHash; for classic requests, use a server-managed nonce. This helps reduce tampering and replay exposure. Values in either field are visible in cleartext to the app and Google, so hash or encrypt sensitive data.
  2. Validate on the backend. Check request details against the original protected request and the freshness requirements. Do not rely on the client alone to interpret or enforce the verdict.
  3. Start by observing. Review how verdicts behave for the app’s actual audience before enforcing a new policy. Google recommends using telemetry to understand the effect of policy changes.
  4. Use graduated responses. Different outcomes can lead to different controls—for example, allowing an action, requiring additional verification, limiting it, or blocking it. Provide an actionable remediation path when an outcome may be recoverable.
  5. Plan for failures. Account for unavailable or unevaluated verdicts, API disruption, and revoked device keys. Avoid treating every missing result as proof of malicious activity.

Standard and classic requests: the trade-off

Request type Assessment behavior Operational considerations
Standard Uses caching and Play-managed protections. Google describes average latency as a few hundred milliseconds. Bind the protected request with requestHash.
Classic Triggers a fresh assessment. Google describes average latency as a few seconds; it uses more user data and battery. The developer must mitigate replay, including with a server-managed nonce.

Those latency descriptions are API behavior figures, not measurements of security effectiveness. The official documentation cited here does not quantify real-world false-positive rates, bypass rates, or overall detection accuracy, so a verdict should not be presented as perfect detection.

Best Value
Tracfone Moto g Play 2024 Prepaid Phone with a 1-Yr Plan Included
  • Carrier: This phone is locked to Tracfone, which means this device can only be used on the Tracfone wireless network. Activating is easy, just 3 steps.
  • ACTIVATION Promotion: Includes 1500 min, 1500 texts & 1500 MB Data + add more as you need it
  • CAMERA SYSTEM: 50MP Quad Pixel camera. Capture sharper, more vibrant photos day or night with 4x the light sensitivity.
  • PERFORMANCE: Blazing-fast Qualcomm performance. Get the speed you need for great entertainment with a Snapdragon 680 processor and 4GB of RAM.
  • 64GB built-in storage. Get plenty of room for photos, movies, songs, and apps. Made for US

What a passing result does—and does not—mean

A result can raise confidence in the specific property it measures. For example, PLAY_RECOGNIZED says something about the app’s package and certificate relative to Play distribution records; MEETS_DEVICE_INTEGRITY says the device met Google’s criteria for that label. Neither proves that the user is trustworthy, that the app has no vulnerabilities, or that the current transaction is legitimate.

Keep the policy proportionate to the action being protected. A missing or negative verdict can reflect a weak or unrecognized environment, absent prerequisites, account or store state, or a technical problem. It can help limit abuse while still excluding legitimate users or failing to answer questions beyond its scope.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Windows Errors? Fix Them Before They SpreadFree repair scan
Outdated Drivers Are Slowing You DownFree scan - exact matches

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.