How to Tell if an APK You Downloaded Is Safe
A friend sent me an APK last month asking if it was fine to install. It was not, and the reasons it was not are the same handful of things I check every single time.
A locked, unopened package is exactly how you should treat every APK from outside the Play Store.
In this post
- Where the APK actually came from matters more than anything else
- Checking the developer, not just the app name
- Signature verification, in plain terms
- Permissions requested before you even open it
- Scanning it before install, not after
- Behavior after install that should worry you
Sideloading is not inherently reckless. F-Droid, GitHub releases from open source projects, and manufacturer-direct downloads are all legitimate sources people use every day, myself included. The risk is not the act of installing outside the Play Store, it is doing it without checking anything first. Here is the actual process I go through, roughly in order of how quickly each step can save you.
Where the APK actually came from matters more than anything else
Before I look at anything technical, I look at the source. A link from the developer's own GitHub releases page, their official website, or a reputable catalog like F-Droid is a reasonable starting point. A link from a random file-sharing site, a forum post with no other context, or a message forwarded through WhatsApp with no explanation is not, regardless of how legitimate the app name sounds.
A trick worth knowing: plenty of malicious APKs are named after popular apps and even mimic their icon and description almost perfectly. The name on the file tells you nothing. The domain it came from tells you a lot.
A pattern worth remembering: if the only way you found the download was through a search result for a "free" or "cracked" version of a normally paid app, treat it as compromised until proven otherwise. This is one of the most consistent delivery methods for Android malware, because it targets people who are already primed to ignore a few warning signs to get something for free.
Checking the developer, not just the app name
If the app has any presence on the Play Store at all, even if you are sideloading a version from elsewhere, compare the developer name listed there against whoever published the APK you have. Legitimate developers are consistent about this across platforms. If the Play Store listing shows one publisher and your download page claims to be from someone else entirely, that mismatch alone is enough reason to stop.
For open source apps, check whether the project has an actual repository with commit history, issues, and more than one contributor. A GitHub account created two weeks ago with a single commit and no other activity is a different level of trust than a project that has been maintained for years.
Signature verification, in plain terms
Every APK is cryptographically signed by its developer. If a project publishes its signing key fingerprint on their official site or repository, you can confirm the file you downloaded matches it before installing. On a computer with the Android SDK platform tools installed, this looks like running:
apksigner verify --print-certs yourapp.apk
and comparing the resulting fingerprint against what the developer has published. It takes an extra minute and it is the single most reliable technical check available to an average user, since a mismatched signature almost always means the file has been repackaged by someone other than the original developer, whether that is a malware distributor or a pirate site slipping something extra in.
Permissions requested before you even open it
Android shows you the full permission list at install time for sideloaded apps, and this is worth actually reading rather than tapping through. A simple offline puzzle game asking for SMS access, contacts, and Accessibility Service has no legitimate reason to want any of that. Cross-reference what the app claims to do against what it is asking permission to do. A mismatch here is one of the clearest signals available, and it costs nothing but a few seconds to check.
Scanning it before install, not after
Before installing, I run the file through VirusTotal, which checks it against dozens of antivirus engines at once and is free to use for individual files. It is not perfect, a clean result does not guarantee safety and a single flagged engine out of sixty does not automatically mean malware, but it is a fast, free step that catches a meaningful share of known threats before they ever touch your device.
Google Play Protect also scans sideloaded apps on most devices by default, even ones installed outside the Play Store, as long as it is enabled in your device settings. Make sure it is on. It is not a complete solution on its own, but it is a real second layer, not a formality.
Behavior after install that should worry you
Even after checking everything above, keep watching for the first few days after installing something new:
- Battery drain that is noticeably worse than before, especially when the app is not actively in use
- Data usage that does not match what the app should reasonably need
- Unexpected permission prompts appearing later, asking for access the app did not request at install
- New icons or shortcuts appearing that you did not add yourself
- Your device suddenly asking to enable Accessibility Service or Device Admin for an app that never needed it before
Any of these after installing something from outside the Play Store is a reasonable trigger to uninstall first and investigate after, rather than the other way around.
The honest bottom line
None of these checks are foolproof individually. A sophisticated attacker can fake a lot of this. But almost none of the Android malware that actually reaches ordinary people is sophisticated. It relies on nobody checking anything at all. Doing even three or four of the steps above puts you well outside the profile of who most of this malware is designed to catch.
Sideloading is not the mistake. Sideloading without a process is. The checks here take a few extra minutes the first few times, and after that they become automatic enough that you barely notice doing them.