SPIC - Play Integrity Checker

Review by eFreeware

If you build Android apps and need to know whether a device and install can be trusted, SPIC is the sort of tool that answers a question you would otherwise have to write code to ask. It is a small demo app from developer Henrik Herzig that shows how the Play Integrity API works and, alongside it, how the older SafetyNet Attestation API behaves. The point is not to protect your app for you; it is to let you watch what those services return.

That makes it a developer utility rather than something a general audience would keep on a phone. The app has been installed more than 100,000 times and holds a 4.2 average from 420 ratings, which suggests a fair number of people in that technical audience have found it useful enough to rate. It is free, carries no ads and offers no in-app purchases, so there is nothing to weigh beyond the time it takes to try it.

Built for people shipping Android apps

The clearest fit is an Android developer who is adding integrity checks to an app and wants a reference for how the APIs are called and what comes back. Seeing a working example is often faster than reading documentation alone, and SPIC exists to be that example. It is also relevant if you maintain a backend that has to decide whether a client is trustworthy, because the app covers both halves of that exchange.

It is less obviously useful to someone who only wants to confirm that their own phone is in good standing. The app is a demonstration of an API, not a consumer security scanner, and its value comes from the verdict details rather than a simple pass or fail. If you are curious about how device attestation works and are comfortable reading code, you are close enough to the intended audience to get something out of it.

Two APIs, one verdict at a time

SPIC's core job is to request an integrity verdict from the Play Integrity API and show you the result. The developer also includes a demo of the SafetyNet Attestation API, which is deprecated. Having both in one place is handy when you are migrating an older codebase, since you can compare what each service returns without maintaining two separate test projects.

The verdict the app receives can be inspected right on the device, which keeps the first step of experimentation simple. That local view is enough to understand the shape of the response and check that the API call itself is working before you involve any infrastructure.

Sending verdicts to your own server

The second capability is the one that matters for production thinking. Rather than stopping at the device, SPIC can send the verdict to a remote server so it can be validated there. That mirrors how integrity checks are normally used in a real app, where the client is not the final judge of its own trustworthiness.

The developer is upfront that the server side has to be self-hosted for now, so this part of the demo assumes you can run your own endpoint. That is a reasonable expectation for the audience the app targets, but it does mean the remote validation path is not a turnkey feature you can try without some setup on your side.

Open source, and free of charge

SPIC is free to install, shows no ads and includes no in-app purchases, so there is no paid tier to consider and nothing to unlock. Both the Android app and the server code are open source and available on GitHub. For a tool whose whole purpose is to demonstrate an API, being able to read the source is arguably the most valuable part of the package.

The app was released in January 2023 and last updated in February 2023. The most recent changes added a licenses page, fixed the privacy link, and moved the source code links from GitLab to GitHub. Those are housekeeping updates rather than new capabilities, which fits a demo app whose scope is deliberately narrow.

What else covers this ground

The obvious alternative is the official documentation and sample code that Google publishes for its integrity services, which is where most developers start. SPIC's advantage is that it puts the request, the verdict and the server-side validation into one small, readable project you can study end to end.

If your interest is broader app security rather than attestation specifically, a general security toolkit or a code audit tool would be a different purchase entirely, and not a substitute for this. Within its niche, SPIC competes mainly with writing your own throwaway test app, and it saves you that effort.

A narrow tool that does its one job

SPIC is worth installing if you are an Android developer working with Play Integrity or migrating away from SafetyNet and you want a compact, open-source example to read and run. It is free, ad-free and small in scope, and that scope is exactly what makes it useful.

It is not aimed at general users, and the self-hosted server requirement means the remote validation path asks something of you before it does anything. For the right reader, though, it is a practical shortcut through a topic that is easy to get wrong, and the source code alone justifies the download.

What's new in version 1.4.0

- added licenses page and working privacy link - changed source code links from GitLab to GitHub