How to check an Android APK source before installing

An APK is an Android app package. Before installing one, make sure you know who provided the file. A familiar name or a polished download page does not establish that a copy is genuine.

Check the source

• Look for a download location published through a channel you can independently verify as belonging to the app operator. Check the full web address, including the domain, before tapping.
• Avoid links in forwarded messages, shortened URLs and pages that imitate an official site. An HTTPS connection protects the connection but does not, by itself, prove that the file is trustworthy.
• If the operator publishes a version, file size or checksum, compare it with the file you received. Stop if the details do not match or if you cannot establish the source.

Review the Android install prompt

Android may ask you to allow a browser or file manager to install apps from that source. Grant that permission only when you understand why it is needed. After installation, review the permission in your phone settings and turn it off if you no longer need it. Menu names vary between Android devices.

Read the permissions the app requests. If a request seems unrelated or the app behaves unexpectedly, stop and check with a verified support channel. Never rely on an unverified download link simply because it appears on a guide page. Read our installation guide and safety guide for more checks.