How to Check an APK Before You Install It (A Practical 2026 Checklist)

Sideloading is one of Android's best features. You can install an older version of an app, get an update early, or use apps that are not on Google Play. It is also how most Android malware reaches people. Many malicious apps are copies of real apps, repackaged with extra code and uploaded to a download site that looks legitimate.

This is the routine I use before installing any APK from outside Google Play. It takes about five minutes.

1. Start with the source, not the file

Most problems are decided before you even download the file. In rough order of trust:

If an app is free on Google Play, there is rarely a good reason to get it anywhere else.

2. Check the signing certificate

Every APK is signed by its developer. Android will only install an update when it is signed with the same key as the version already installed. That makes the signature the most useful check you have.

• Android: apps such as App Manager (open source) show an APK's signing certificate before you install it.
• Computer: with the Android SDK build tools installed, run:

apksigner verify --print-certs app.apk

Compare the SHA-256 certificate digest with a version you trust, such as the copy already on your phone or one from the developer's site. If they do not match, stop. That is what a repackaged app looks like.

3. Read the permissions

Ask whether each permission makes sense for what the app does:

• A photo editor needs access to your photos. It does not need SMS, call logs or contacts.
• A video player should not ask for Accessibility access or Device admin rights.
• Treat any request to "display over other apps" from an app that has no reason to show overlays as a warning sign.

Accessibility and device admin are the two permissions banking trojans love most. Do not grant them unless you understand exactly why the app needs them.

4. Scan the file

Upload the APK, or just its SHA-256 hash, to VirusTotal. A clean result is not proof that a file is safe. New malware is often missed at first. But several detections from well-known engines is a clear reason to delete the file.

Keep Google Play Protect turned on. It also scans sideloaded apps. Never turn it off just because a download site tells you to.

5. Watch for the classic red flags

• The site makes you complete "human verification", surveys or offers before the download starts.
• The file name says one thing and the package name says another.
• The APK is much smaller or much larger than the official version.
• The site promises "premium unlocked" features for an app whose premium features run on the developer's servers. Those mods often do not even work.
• The download arrives as a ZIP with an .exe inside, or asks you to install a "profile".

6. Know the split formats

Many modern apps are no longer a single APK. You may get XAPK, APKM or APKS files. These are ZIP containers holding a base APK plus split APKs (and sometimes OBB game data). Android's built-in installer cannot open them, which is why you see errors such as "There was a problem parsing the package". You need a split-APK installer, or bundletool install-apks for .apks files. The same checks apply to every APK inside the archive.

7. After installing

1. Turn the "Install unknown apps" permission back off for your browser or file manager.
2. Open the app's permission screen and remove anything it does not need.
3. Watch for full-screen ads, battery drain or new icons you did not install in the following days.

Quick checklist

• [ ] Trusted source (Play, developer site, F-Droid or a reputable mirror)
• [ ] Signature matches a trusted version
• [ ] Permissions make sense
• [ ] No VirusTotal detections from major engines
• [ ] Play Protect still on
• [ ] "Install unknown apps" switched off again

I write beginner-friendly Android guides at GetAPKGuide. If you want a longer, step-by-step version of this routine, see how to check if an APK is safe. For split files, see what an APKS file is and how to install it.