How to Install an APK Safely on Android (2026)

Installing an APK is not risky in itself. Installing one you have not checked is - and the checking takes about two minutes.

Android phone showing an APK install prompt with a security check in progress

An APK is just the installer file for an Android app, the same way an EXE is for Windows.

Google Play hands you one every time you install something, quietly, without ever showing you the file.

Doing it yourself is only more dangerous if you skip the checks Play would have done for you.

The short version

Get the file from a source that publishes version numbers and file sizes, such as our Android APK section. Check it before installing, then allow installs for the app you are opening it from.

Read the permission list on the install screen and stop if it asks for Accessibility, Device admin or SMS access without an obvious reason. After installing, open Play Protect and let it scan.

Why anyone sideloads in the first place

The assumption that sideloading means piracy is out of date. Plenty of legitimate apps are simply not on Play, or vanish from it without warning.

TiviMate is the obvious recent case - it disappeared from the Play Store again in July 2026, leaving existing users unable to update through the normal route.

Others were never eligible. MX Player Custom Codec exists as an APK precisely because Play will not distribute the patent-encumbered decoders it contains.

Check the file before you install it

This is the step that separates safe sideloading from the other kind, and it is the one almost everybody skips.

Compare the version and size against the developer's own page or the Play listing. A file that is dramatically larger or smaller than the official build has had something added or removed.
Run it through our APK Checker, which reads the package name, version, signing certificate and the permissions it will request, before anything touches your phone.
Check the package name matches the real app. A convincing copy of a well-known app will differ by a character or a whole word in the package name, which is the one thing a fake cannot fake.

If the publisher lists a SHA-256 hash, compare it. On Windows this is built in, no download needed:

certutil -hashfile app.apk SHA256

A hash that does not match means the file was altered after the developer released it. There is no innocent explanation for that.

How to install the APK

Android 8 and newer no longer have a single global "unknown sources" switch. Permission is granted per app, to whichever app is opening the file.

Allow installs from the app you are using. Go to Settings, then Apps, then Special app access, then Install unknown apps, pick your browser or file manager and turn it on.
Open the APK from your Downloads notification or your file manager.
Read the permission summary on the install screen rather than tapping straight through.
Tap Install, then Open.
Open the Play Store, tap your profile, then Play Protect, and run a scan. It checks sideloaded apps too.

Menu wording varies between Samsung, Xiaomi, OnePlus and stock Android, and it moves between versions. If the path above does not match your phone, search your Settings app for "unknown" and it will find it.

What changes on 30 September 2026

Google is introducing developer verification, and it affects sideloading directly. From 30 September 2026 in Brazil, Indonesia, Singapore and Thailand, apps will need to be registered to a verified developer to install normally on certified devices.

The rest of the world follows during 2027.

This is not a ban

You will still be able to install an app from an unverified developer. It moves behind an advanced flow that asks you to acknowledge the risk and complete a one-time setup first.

The other route stays open. Installing over USB from a computer with adb install app.apk is unaffected, which is why it is worth knowing the command exists.

In practice, most apps worth installing will be from verified developers well before this reaches you. It is worth knowing about now so the extra screen does not read as something being broken.

The permissions that should stop you

Malware needs specific permissions to be worth writing. If an app asks for one of these and the reason is not obvious, close the installer.

Accessibility service - lets an app read everything on screen and tap on your behalf. Legitimate uses exist, but this is the single most abused permission on Android.
Device admin - makes the app difficult to uninstall. Almost nothing outside corporate device management needs it.
SMS and call log - the route to your two-factor codes. A video player has no business here.
Display over other apps - allows a fake login screen to be drawn on top of a real one.

Android 13 and newer helps here. Sideloaded apps are blocked from Accessibility and notification access by default, and you have to go into App info and lift the restriction by hand - so if an app pushes you to do that, treat the request itself as the warning.

APKs you should never install

Some files are not worth checking because the category itself is the problem.

Modded, cracked, premium unlocked, pro free

Skip all of it. To unlock paid features somebody had to alter and re-sign the app, which means the signature no longer matches the developer's and you are trusting whoever did the altering instead.

The other tells are easy to spot once you know them. A download that arrives as its own installer or "download manager" rather than a plain .apk file, a page pushing you to install a second app first, or a file whose size is nowhere near the official build.

None of these are grey areas. Every one of them means the file is not what the developer published.

The errors you will actually hit

Two messages account for most failed installs, and neither means the file is malicious.

"App not installed" usually means a version of the same app is already on the phone with a different signature. Uninstall the existing copy first, but export anything you care about, because uninstalling takes its data with it.

"There was a problem parsing the package" means the file is incomplete, corrupt, or built for a different Android version or chip architecture than yours. Download it again first, and if it still fails, check what your device actually supports with Codec Info.

Quick questions

Is installing an APK illegal?

No. Android supports it deliberately, and installing a free app from its developer is entirely legal. What can be illegal is what is inside the file, which is why modded and cracked builds are a different matter.

Will sideloading void my warranty?

No. Installing an APK is a normal, supported action and changes nothing about your device. You are thinking of rooting or unlocking the bootloader, which are different things entirely.

Do I need an antivirus app to install APKs safely?

Not usually. Play Protect is built into Android, scans sideloaded apps, and covers most of what a third-party scanner would catch. Checking the file before you install it does far more than any scanner does afterwards.

Why does the app not update after I sideload it?

Because Play only updates apps it installed. A sideloaded app has to be updated by downloading the newer APK yourself, unless the app has its own built-in updater.

Can I install an APK on Android TV or a Fire Stick?

Yes, and the principle is identical, but there is no file manager by default. Most people use a sideloading helper app from the device's own store, then grant it install permission the same way.

Should I delete the APK file after installing?

You can, and it frees up space since the app itself is already installed. Keeping it is useful if you might need to reinstall that exact version later.