The latest articles on DEV Community by Ali Babar (@ali_babar_b67e3e0877bf53b). https://dev.to/ali_babar_b67e3e0877bf53b https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4089615%2F7cd4409e-0d89-42cb-aec9-1f0576b877f1.png https://dev.to/ali_babar_b67e3e0877bf53b en Ali Babar Mon, 26 Oct 2026 14:54:00 +0000 https://dev.to/ali_babar_b67e3e0877bf53b/a-short-checklist-for-installing-an-android-apk-safely-outside-google-play-19jg https://dev.to/ali_babar_b67e3e0877bf53b/a-short-checklist-for-installing-an-android-apk-safely-outside-google-play-19jg <p>Installing an APK from outside Google Play is normal for beta builds and small projects, but it is also one of the ways malware spreads. This is the short checklist I use myself, and the one I try to make easy for people who install my own app.</p> <h2> 1. Start from the developer's own page </h2> <p>Open the download from the developer's official website or code repository, not from a file forwarded in a chat. Check that the address in the browser is the one the developer lists. If the only source is a random mirror, be careful.</p> <h2> 2. Compare name, version and size </h2> <p>A real release page usually shows the version and the file size. If the file you downloaded is much bigger or smaller than listed, do not install it.</p> <h2> 3. Check a hash if one is published </h2> <p>Some developers publish a SHA-256 hash next to the download. On Windows run <code>certutil -hashfile app.apk SHA256</code>. On Linux or macOS run <code>sha256sum app.apk</code>. The result should match exactly.</p> <h2> 4. Allow installs for one app only </h2> <p>Android asks you to allow "Install unknown apps" for the browser or file manager you used. Allow it for that one app, install, and then switch it off again under Settings, Apps, Special access, Install unknown apps.</p> <h2> 5. Read the permissions </h2> <p>A property listing app does not need your SMS or call log. If a permission does not match what the app does, deny it or skip the app.</p> <h2> 6. Keep Play Protect on </h2> <p>Google Play Protect can scan apps that were installed outside the store. If it shows a warning, stop and read it before you continue.</p> <h2> 7. Look for a privacy policy and a real contact </h2> <p>A developer who cares about users publishes what data the app collects and how to reach them. No policy and no contact is a red flag.</p> <h2> An example from my own project </h2> <p>I am the developer of Bahria Property Hub, an Android app with property leads for Bahria Town Karachi: homes and plots for sale or rent, and what buyers and tenants are looking for. It is not on Google Play yet, so version 1.0.0 is shared as an APK (21.4 MB, for 64-bit phones).</p> <p>If you want to practise the checklist on a real file, these are the official places:</p> <ul> <li>Website: <a href="https://bahriapropertyhub.com/" rel="noopener noreferrer">https://bahriapropertyhub.com/</a> </li> <li>Privacy policy: <a href="https://bahriapropertyhub.com/privacy-policy" rel="noopener noreferrer">https://bahriapropertyhub.com/privacy-policy</a> </li> <li>Release page with the APK: <a href="https://github.com/alibabr3212-crypto/bahria-property-hub-apk/releases/tag/v1.0.0" rel="noopener noreferrer">https://github.com/alibabr3212-crypto/bahria-property-hub-apk/releases/tag/v1.0.0</a> </li> </ul> <p>What else do you check before installing an APK? I would like to add more points to this list.</p> android security mobile beginners