Checking an APK before you install it
Installing from outside the Play Store is an ordinary thing to do, and it is how a great deal of legitimate software reaches Android. The risk is not the act of sideloading, it is installing a file that is not what it claims to be. Four checks catch nearly all of that, and none of them needs a tool.
The four checks
- Check the package name, not the display name A repackaged app usually keeps the visible name and changes the identifier by a character. The package name is what Android actually uses, and it is shown on the download page.
- Check that it installs over your existing copy If Android accepts it as an update, the signing key matches the app you already had. If it refuses, the key differs, and that deserves an explanation.
- Read the permission list before confirming This is the single most informative screen in the process. A mismatch between what the app does and what it asks for is the clearest warning available.
- Compare the file size against the page A size well below what the page states means a truncated download. A size well above the Play Store version means extra code.
Pubblicità
What a repackaged app looks like
| Signal | Why it matters |
|---|---|
| Package name differs by one character | The classic impersonation technique |
| Asks for accessibility or device admin | Far beyond what most apps need |
| Much larger than the official build | Extra code has been added |
| Will not install over the official version | Different signing key |
| Version number ahead of the official release | There is no such release |
| Promises paid features unlocked | Somebody modified it, which required re-signing it |
- A build that updates your existing app cleanly
- Permissions that match what the app does
- A version that exists on the developer's own site
- An older version of an app you already trust
- Modified builds promising unlocked features
- Anything requiring Play Protect to be disabled
- A banking or payment app from anywhere but the official channel
- A file whose size does not match the page
Where to be strict and where to relax
Risk is not uniform. The consequence of a bad media player is different from the consequence of a bad banking app, and it makes sense to apply different standards.
For anything holding money, identity or two-factor codes, use only the official channel, every time, with no exceptions. For a game, a media player or a utility, the four checks above are proportionate. The category where people go wrong is messaging, which feels casual and holds a great deal.
After installing
- Watch the first launch An app that immediately requests permissions unrelated to its function is worth uninstalling straight away.
- Check battery and data after a day Unexpected background activity from a small utility is a real signal.
- Leave Play Protect on It scans sideloaded apps too, and the harmful-app detection is worth having.
- Keep the source in mind for updates Mixing sources for the same app leads to the signature problem later.
Package name, signature, permissions, file size. Four checks, none of them technical, and they catch nearly everything.
Frequently asked questions
Is sideloading dangerous?
Not inherently. Installing a file that is not what it claims to be is dangerous, which is a different problem with a different fix.
Does an antivirus app help?
Marginally. Play Protect already scans installs, and the checks in this article catch more than a scanner does.
Why would a genuine app fail to install over the Play version?
Google Play re-signs uploads with its own key, so a build from the developer's site can legitimately differ. It is a question to answer, not proof of anything.
Read next
This is not a rivalry. Each does something the other cannot.
You are not buying encryption. You are buying an operator whose income does not depend on you.
For a plain ZIP either works. For a split, password-protected archive, only one does.
