Installing an APK from outside Google Play is normal for beta builds and small projects, but it is also one of the ways malware spreads. This is the short checklist I use myself, and the one I try to make easy for people who install my own app.
1. Start from the developer's own page
Open the download from the developer's official website or code repository, not from a file forwarded in a chat. Check that the address in the browser is the one the developer lists. If the only source is a random mirror, be careful.
2. Compare name, version and size
A real release page usually shows the version and the file size. If the file you downloaded is much bigger or smaller than listed, do not install it.
3. Check a hash if one is published
Some developers publish a SHA-256 hash next to the download. On Windows run certutil -hashfile app.apk SHA256. On Linux or macOS run sha256sum app.apk. The result should match exactly.
4. Allow installs for one app only
Android asks you to allow "Install unknown apps" for the browser or file manager you used. Allow it for that one app, install, and then switch it off again under Settings, Apps, Special access, Install unknown apps.
5. Read the permissions
A property listing app does not need your SMS or call log. If a permission does not match what the app does, deny it or skip the app.
6. Keep Play Protect on
Google Play Protect can scan apps that were installed outside the store. If it shows a warning, stop and read it before you continue.
7. Look for a privacy policy and a real contact
A developer who cares about users publishes what data the app collects and how to reach them. No policy and no contact is a red flag.
An example from my own project
I am the developer of Bahria Property Hub, an Android app with property leads for Bahria Town Karachi: homes and plots for sale or rent, and what buyers and tenants are looking for. It is not on Google Play yet, so version 1.0.0 is shared as an APK (21.4 MB, for 64-bit phones).
If you want to practise the checklist on a real file, these are the official places:
- Website: https://bahriapropertyhub.com/
- Privacy policy: https://bahriapropertyhub.com/privacy-policy
- Release page with the APK: https://github.com/alibabr3212-crypto/bahria-property-hub-apk/releases/tag/v1.0.0
What else do you check before installing an APK? I would like to add more points to this list.
Top comments (0)