Skip to content

The most private app store, period.

Browse and search the entire catalog locally. Know who is behind every app and install with peace of mind.

Fully open source and built on open protocols.

Browse apps

Signal, Tor Browser, Bitwarden, NewPipe, Immich and thousands more

Zapstore on Android: the home screen, with curated stacks and recent activity

What you look for never leaves your device

Like the trail maps in a hiking app, the whole catalog is local. Search all you want. What you look for and what you install stays between you and your phone.

Zapstore search for “hiking trail maps”, answered from the catalog on the device

Know who made it and exactly what it does

  1. Who published it

    Developers claim their apps by cryptographically linking the Android key that signs them to their Zapstore pubkey. From then on, every release carries their name, and you see the developer’s web of trust before you install.

  2. Scanned for you

    The catalog relay inspects every release file, so you don’t have to take the developer’s word for it. The report flags things like trackers, ads, and Google services, and explains every permission in plain words.

  3. Checked before it installs

    Your phone verifies the file’s hash against the signed listing, and its signing certificate against the developer’s claim and the version you already have. If anything doesn’t match, nothing installs.

No gatekeeper, not even us

Zapstore ships with a default catalog, and each catalog sets its own rules. Every listing is public, signed data on Nostr, an open protocol, and the catalog relay that serves ours is open source. Add catalogs with stricter or looser rules, replace ours, or run your own. We couldn’t lock you in even if we wanted to.

Where people who use apps meet the people who make them

Signing in is optional. Once you do, you can comment on apps, share stacks, and send zaps, small private Bitcoin Lightning payments, to support the apps you use.

Zap the developer

Your zap goes straight to the developer, or to the catalog when an app is unclaimed.

Zapping an app. The sats go to the developer.

Ask, report, hear back

Comments are public, show which version you ran, and the developer can reply in the thread.

A comment thread on an app, with a reply from the developer.

Share stacks with friends

A stack is a list of apps, like a starter kit for a new phone. Anyone can browse and share a public stack.

Public stacks from people on Zapstore, including CypherStore, Elch, and Farran.

Zapstore for developers

Publish your Android app in minutes, and keep every zap.

Start publishing

In their own words

Unedited public posts from thousands of daily users and the developers who publish here.

Take back your apps

Install and start browsing right away.

View the source

Ideal for GrapheneOS and LineageOS. It needs no Google account and no Google services.

Get Zapstore for Android

  1. Tap Download APK below.Scan the code with your Android phone’s camera.
  2. If Android asks, allow your browser to install unknown apps.
  3. Open Zapstore and finish the onboarding.
Download APK

v2.0.4 · 71.2 MB · Android 10+

Verify the download

On a computer, run shasum -a 256 <the file you downloaded>. It should print: b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137

If you have zsp, Zapstore’s publishing tool, zsp utils extract-apk <the file you downloaded> works too. Its hash should be the same SHA-256: b13e01319fecf0b3ba1fd60132758bd0fa08a235836c52d44fddb412cf1b7137

On the phone, AppVerifier should show this signing certificate: 99e33b0c2d07e75fcd9df7e40e886646ff667e3aa6648e1a1160b036cf2b9320

Source code All releases and notes

Get zsp

  1. Download the file for your computer.
  2. Make it executable and put it on your PATH.
  3. In your project folder, run zsp.

Have Go? This does the same:

go install github.com/zapstore/zsp/v2/cmd/zsp@latest
macOS, Apple silicon Linux, x86-64 Linux, arm64

v2.0.1 · macOS and Linux

Verify the download

On your computer, run shasum -a 256 <the file you downloaded>. It should print the SHA-256 for the one you chose.

macOS, Apple silicon · 18.6 MB 99018fb9744e5ace2b44557550dc333496239912c0e9b1137266d4922c803346

Linux, x86-64 · 23.8 MB 1ef5373f8ecd9ba63d2c3fab98abb0d31b2244a2aac31b3749fb205c7d5f5b38

Linux, arm64 · 22.1 MB e421005ee47cba58293dce4277bb784e4cfe706dbbcb8617d671629d0238be18

Source code All releases and notes