How to check an APK is safe before installing

What "safe" means here

A safe APK is the build the developer published, unmodified. A repackaged or "modded" APK has been rebuilt and re-signed by someone else; it may carry extra code and can never update the Play-installed copy anyway. The checks below tell the two apart.

1. Package name

The package name (for example org.telegram.messenger) is unique on Google Play. Compare the name shown on the download page with the Play listing's URL, which contains id=<package name>. A look-alike name such as org.telegram.messenger.pro is a different app.

2. Signing certificate

Every APK is signed, and the developer's key does not change between versions. On the phone, App Manager or Package Manager style apps (open source, on F-Droid) show the certificate fingerprint of both the file and the installed app; they must match. On a computer, apksigner verify --print-certs file.apk from the Android SDK prints the SHA-256 of the certificate. If the app is already installed from Play, Android will simply refuse a package signed with a different key, which is itself a useful test: it fails with App not installed.

3. Permissions

Open the package in a file manager or installer and read the permissions list before confirming, or check the Play listing's Data safety section. A wallpaper app that wants SMS access, or a game that wants Accessibility service, is a red flag whatever its source.

4. Hash comparison

When two sources offer the same version, the file's SHA-256 should be identical. On Android, Hash Droid or any file manager with a checksum function computes it; on a computer use shasum -a 256 file.apk (macOS, Linux) or certutil -hashfile file.apk SHA256 (Windows). Play Protect also scans the file at install time and blocks known malware.

Warning signs

• A version number higher than the one on Google Play.
• "Unlocked", "premium" or "mod" in the file name.
• A package that asks for the Accessibility or Device admin permission without an obvious reason.
• A signature that does not match the installed copy.

Files on this site are served from an established mirror that stores the packages developers upload to Play; we do not rebuild or modify them. The checks above still apply and take less than a minute.