How to install an APK file safely on Android
An APK is the file format Android apps come in. Installing one yourself, often called sideloading, is normal and legal, but it removes the checks the Play Store does for you. These steps put some of them back.
1. Only download from the developer
The most common way to get malware on a phone is a fake copy of a popular app. Use the developer's own website or official code page, type the address yourself or follow it from their verified account, and ignore re-uploads, mirror sites and links sent in messages.
2. Check the file
- Name and size. It should match what the developer lists. A big difference is a red flag.
- Checksum. Some developers publish a SHA-256 value for each file. You can compute the same value and compare. On Windows, open a command prompt and run
certutil -hashfile file.apk SHA256. If the two values differ even slightly, delete the file.
3. Allow the install for one app only
Android doesn't let you open an APK until you allow your browser or file manager to install unknown apps. The setting is per app, and usually found under Settings > Apps > Special access > Install unknown apps (the wording differs by brand). Allow it for the one app you used to download the file, and switch it off again once you are done.
4. Read what it asks for
When the installer opens, check the app name and the permissions. After the install, review them in Settings > Apps, select the app, then Permissions. Remove anything that doesn't make sense for the app's job.
5. Respect the warnings
If Google Play Protect warns you, read what the message means before you do anything else. A warning on an unknown app is a good reason to stop.
6. Clean up
- Delete the APK file from your Downloads folder once the app is installed.
- Switch off "install unknown apps" for the browser again.
- Keep Play Protect enabled.
- Check for updates from the same source from time to time, since apps installed from a file do not update themselves.
What if something goes wrong
If you installed something you don't trust, uninstall it from Settings > Apps. If it won't uninstall, it may hold device administrator or accessibility rights. Remove those first in Settings, then uninstall. If you entered passwords while it was installed, change them from a different device.
Summary
Sideloading is fine when you trust the source, check the file, give out as little permission as possible, and clean up afterwards.