Is it safe to install APK files? A 7-point checklist
By AltFTool Team · Updated 1 Nov 2026
The APK format is not the risk; the source is. A file from the developer's own site is as safe as that developer. Re-uploaded or 'modded' files from random sites are where malware hides.
The checklist
- Source: download from the developer's own page, not a mirror or a 'mod' site.
- Checksum: the SHA-256 of your file matches the one on the official page.
- Size: the file size matches the listed size to the byte.
- Permissions: they make sense for what the app does. A calculator has no reason to read contacts.
- Play Protect: leave it on and let it scan the app when asked.
- Android version: the app supports your version, so you are not tempted by an 'old version' from elsewhere.
- Afterwards: switch 'Install unknown apps' off again for your browser.
Red flags
- The page asks you to turn off Play Protect.
- The app wants Accessibility access or to be a device admin for no clear reason.
- The download is a .zip or .xapk from a site that is not the developer's.
- The 'free' version of a paid app.
Questions
Are AltFTool APKs scanned?
Each AltFTool APK page shows the SHA-256, the signing certificate and the full permission list read from the file, so you can check it yourself. Play Protect also scans sideloaded apps when you install them.
