How Do You Know If an APK Is Safe to Install?

Installing an APK outside Google Play raises an important question:

How do you know what you're actually installing?

There are several things worth checking before installing an APK.

1. Know who published it

The first question should be: where did this APK come from?

A download page should make the developer or publisher clear.

2. Check the package name

If you're expecting a particular application, the package name should match what you expect.

3. Check the APK signature

Android applications are digitally signed. The signing information can help establish whether an APK is associated with the expected signing identity.

4. Look at the version

The version number and release information should be clear. If a download suddenly has a strange version or unclear release history, that's worth investigating.

5. Review permissions

Look at what the application is requesting access to and consider whether those permissions make sense for what the app does.

6. Check the source

For open-source applications, being able to inspect the source code and compare releases can provide additional context.

7. Verify the file when possible

A SHA-256 hash can be used to verify that the file you downloaded matches a known file.

There isn't one magic signal that makes an APK trustworthy.

The more useful approach is to look at the developer, source, signature, version, permissions and file integrity together.

I'm building Aeroapk, and these are some of the things I'm thinking about as I work on Android app discovery and distribution.

Android developers and users: what information do you check before installing an APK?