How to install an APK on Android safely in 2026

Android still lets you install apps from outside the Play Store, and there are good reasons to do it: a regional release you cannot get yet, an app the store has removed, or an update that fixes a bug you have hit. The catch is that a sideloaded file is only as trustworthy as the place you got it from. This guide walks through the safe way to install an APK, and the warning signs that mean you should stop.

Only download from a source you can check

The single most important decision you make is where the file comes from. Prefer the developer’s own website, a well-known open-source repository such as GitHub Releases or F-Droid, or an established catalogue that publishes file sizes and checksums. If a page promises a "mod" or a "premium unlock", assume it is malware until proven otherwise.

Before you download anything, look for a version number, a file size and a date. A download page that cannot tell you which version you are getting is not a download page you should use.

Turn on install permission for one app at a time

Android no longer has one global "allow unknown sources" switch. Instead, you grant install permission to a single app, usually your browser or file manager. Go to Settings, then Apps, then Special app access, and finally Install unknown apps. Pick the app you are downloading with and allow it for now.

Turn the permission back off once you are finished. Doing it this way means a malicious file cannot quietly install itself through an app you trust later.

Check the file before you open it

Open your Downloads folder and look at the file. The name should be recognisable, such as the app name and a version number. If an APK is unusually small, say under a megabyte, be suspicious: it is probably a dropper that downloads the real payload later.

Compare the size with the size published by the developer. If the numbers differ by more than a rounding amount, delete the file and start again.

Install and verify

Tap the APK and follow the prompt. If Play Protect warns you about the app, read the warning rather than dismissing it. Play Protect is not perfect, but it catches a lot of known malware. After installing, open the app and check that it behaves as expected.

Finally, review the permissions it asked for. A simple note-taking app has no business requesting your contacts or your location. If the permissions do not match the job, uninstall it.

When to use the Play Store instead

If the app is available on the Play Store, use it. You get automatic updates and a layer of review that a random download page cannot offer. Sideloading is a tool for the cases where the store is not an option, not the default.

The bottom line

Sideloading is safe when you control the source, the permission and the file. Treat every APK like an email attachment from a stranger: check who it is from, check what it claims to be, and only then open it.