Which Is the Real Binance Official Site? How to Verify Authenticity at the Technical Level
When you search "Binance" in a search engine, the top results are often ad-labelled imitation sites with domains that look plausible: binance-xxx.com, binanceapp.cc, bnance.com, and more. It is hard for ordinary users to tell them apart at a glance. This article does not rely on subjective criteria like "look at the UI" or "look at the logo". Instead it starts from objectively verifiable technical points — domain registration information, HTTPS certificate fingerprints, APK signing certificates, and file hashes — and turns "authenticity identification" into a reproducible operational procedure.
Binance's Real Top-Level Domain
The main domain of Binance's global site is binance.com, which has been in use since 2017. All regional sites are hosted under this top-level domain, such as www.binance.com, accounts.binance.com, and api.binance.com. Beyond this, Binance has registered a batch of backup domains for different scenarios, with common ones including binance.info, binance.vision (the Academy site), and binance.charity (charity project).
It must be stressed that any variant domain with a hyphen — such as binance-app.com, binance-login.com, or binance-pro.net — is not an official Binance asset. Binance's brand policy is conservative and does not use hyphens for subsites. Domains of this kind can essentially be classified as imitations at sight.
App downloads likewise go through the main domain, and the genuine download path is the Official Download Page — not any independent "binance-download" domain.
Query Domain Registration With WHOIS
Open any WHOIS lookup tool (such as who.is or the whois binance.com command line). The real binance.com will show:
- Registration date: 2017-02-08 (or an even earlier record)
- Registrar: typically MarkMonitor or another registrar specialised in serving large enterprises
- Domain status: multiple locks such as clientTransferProhibited and clientUpdateProhibited
- Registrant info: under privacy protection, but traceable to a Binance Holdings-related entity
If the domain you look up was registered only in the last year or two, the registrar is a personal NameSilo/Namecheap account, and there are no locks, it is almost certainly a knock-off. To save money and to retain flexibility to "re-skin", imitation sites cannot possibly afford a service like MarkMonitor that costs thousands a month.
Verify the HTTPS Certificate Fingerprint
Click the padlock in the browser's address bar to see certificate details. The real binance.com currently uses an EV/OV certificate issued by DigiCert or Amazon (OV types are more common recently). The Organization in the subject clearly reads Binance Holdings Limited, and the location is Cayman Islands.
A more hardcore approach is to verify the certificate's SHA-256 fingerprint. In Chrome, click the padlock → Connection is secure → Certificate is valid → Details → Thumbprint, and compare this hexadecimal string with the fingerprint you see on other devices and other network environments. If both visits show exactly the same fingerprint, bound to the same CA, the connection has not been substituted by a MITM in the middle.
Command-line approach:
openssl s_client -connect binance.com:443 -servername binance.com </dev/null 2>/dev/null | openssl x509 -noout -fingerprint -sha256
The outputted fingerprint can be cross-verified against what you see in the browser.
APK Signing Certificate Fingerprint
To tell whether the installation package you downloaded was really compiled by Binance, the most accurate way is to check the signing certificate fingerprint. The signing certificate of the Binance Android app is fixed and does not change across versions (unless Binance proactively re-signs, which is extremely rare and always announced in advance).
Command to extract the fingerprint:
keytool -printcert -jarfile binance.apk
Or use apksigner that ships with the Android SDK:
apksigner verify --print-certs binance.apk
The output shows the SHA-256 certificate fingerprint, the subject DN (Distinguished Name), and the signing algorithm. Record this fingerprint. Next time you download a new version, extract the fingerprint again and compare. If identical, both versions come from the same source; if different, no matter how similar the filename, do not install.
The benefit of this approach: even if the official site is temporarily hijacked, even if the download link is replaced, as long as you have the fingerprint record of past versions in your hand, you have a baseline to compare against.
File Hash Comparison
The SHA-256 hash is a file-level fingerprint — a single-byte change causes a completely different hash. After downloading the APK, compute the hash first:
Windows PowerShell:
Get-FileHash binance.apk -Algorithm SHA256
Linux/Mac:
shasum -a 256 binance.apk
After obtaining the hash, cross-verify via multiple channels — for example, download the same version of the APK separately from different network environments (home broadband, mobile 4G, an overseas VPS) and compute the hash for each. If all three are identical, the download path has not been polluted. If they differ, someone has substituted the file on one of the channels.
The installation package obtained from the Official APK URL, downloaded three times across networks, should produce identical hashes.
Decompilation Spot-Check Approach
For even more cautious users, there is another step — a decompilation spot-check. Open the APK with jadx or apktool and focus on these points:
- Whether the
packagefield inAndroidManifest.xmliscom.binance.dev(Binance's official package name) - Whether the hard-coded API domains inside the app point to
api.binance.comand other official domains - Whether there are suspicious outbound domains, extra request permissions, or unfamiliar receivers
The typical traits of a counterfeit package are: a package name disguised as a string close to but not identical to the real one (e.g. com.binancce.app), or APIs pointing to their own relay servers. These are immediately visible after decompilation.
Using App Store Metadata as an Auxiliary Check
Although Google Play cannot be accessed directly in mainland China, querying iOS App Store entries via apps.apple.com is entirely feasible. The developer name for the genuine Binance app is Binance LTD (or an entity under Binance Holdings), and other apps listed under the developer page are also Binance-series products (such as Binance US or early versions of Trust Wallet).
Cross-check this developer name against the APK signing DN on the Android side. If the APK's signing subject is a company you have never heard of, be suspicious.
Avoid Stepping Into Traps at the Search-Engine Entry Point
The most common source of traffic for phishing sites is search-engine ads and social-media short links. How to avoid them:
- Do not click entries labelled "Ad" / "Sponsored" in search results
- Bookmark the Binance Registration Link and the APK download address in your browser, and only open them via bookmarks thereafter
- Do not click any "Binance" link sent by strangers, no matter if they claim to be customer service
- When verifying a URL, compare letter by letter — watch for visually similar characters like rn/m, l/1, 0/O
The real Binance does not proactively contact you via phone, SMS, or DM, and will not send you an "urgent login link". Any message urging you to "click the link immediately to verify" should set off alarm bells.
Referral Codes and Invitations
After confirming the Binance app you downloaded is genuine, create an account through the Official Registration Link. Entering the referral code P394YSTZ during registration grants a permanent discount on trading fees. The first thing to do after registration is enable 2FA to raise account security to its highest level.
FAQ
Q: How can I quickly view the signing fingerprint of the installed Binance app on my phone?
A: Install a tool like APK Info or App Inspector, find the Binance entry, and the SHA-256 signing fingerprint is displayed directly. Compare it against your previously recorded baseline. Without such a tool, you can also use adb: adb shell pm list packages -f | grep binance to find the APK path, then pull it out and verify with keytool.
Q: Why do imitation sites also have a green HTTPS padlock?
A: A green HTTPS padlock only indicates "this domain matches this certificate", not "this domain is Binance". Let's Encrypt can issue free certificates to any domain, including binance-fake.com. So the key is to check the Organization field in the certificate, not merely the lock.
Q: Where can I find Binance's official publication of the APK signing fingerprint baseline?
A: Binance does not publish the signing fingerprint on a centralised page. The industry convention is for users to record it themselves after installing the genuine version for the first time, as a baseline for future comparison. You can also compare fingerprints from multiple commonly trusted sources (for instance, old versions tagged Verified on APKMirror) to establish an initial baseline.
Q: I have two "Binance" apps installed on my phone and both can log in — how do I tell which is real?
A: Extract the package name and signing fingerprint for each. The one with package name com.binance.dev and a signing subject that is a Binance-related entity is real; the other is likely an imitation. Uninstall the imitation immediately, change your Binance account password, review 2FA settings, and check recent login and withdrawal records.
Q: Do certificate fingerprints change every year? What do I do when they change?
A: HTTPS certificates are typically rotated approximately once a year, so fingerprints change — this is normal. The focus should be whether the certificate subject (Organization) and issuer CA still make sense. The APK signing certificate essentially never changes; any change should be highly suspicious, and should be verified via the official site or social media.