How to install Android apps from outside Google Play more safely

Installing apps from outside Google Play is easy on Android, but fake and modified apps are common. Android Police writer Victor Opata describes a routine that lowers the risk: check where a file comes from, keep Google Play Protect on, and use a free tool called Obtainium to find updates. He says it does not remove every risk.

Check the source first

Before downloading an app file, known as an APK, go to the developer's own website or official release page. A site that offers an app does not always show who uploaded it or whether the file is safe. Some developers publish on F-Droid or GitHub. Those sources show who made the app and list release details.

Be extra careful with sites that offer modified or unlocked versions of popular apps. Free premium features sound tempting, but there is no way to know what was changed. A modified file could carry unwanted code or ask for permissions it should not need.

Look inside the file

A tool called APK Analyzer can open a downloaded file before installing. It shows the signing certificate, permissions, version details and more. A signing certificate is a digital stamp from the developer. Android lets an app update only if the new version carries the same stamp as the installed one.

• Review the permissions. An app asking for contacts or text messages with no clear reason is a warning sign.
• Allow installs from unknown sources only for the app doing the installing, such as a file manager.
• Turn that permission off again when finished.

Keep Play Protect on

Google Play Protect scans apps on a phone, including ones that did not come from the Play Store, and warns about anything harmful. To check it, open the Play Store, tap your profile picture, and choose Play Protect. Also make sure the Improve harmful app detection setting is on.

Stop hunting for updates

Apps installed this way do not update on their own. Obtainium fixes much of that. Add an app by its release page, and the tool checks sources such as F-Droid and GitHub for newer versions. That puts update checks in one place. APKUpdater is another option that checks several supported repositories.

An update still deserves a look at its source before installing. Finding a newer file does not mean it is the right one. If a developer changes the signing key, the developer should explain why. The release notes are a good place to look.

If an update fails

A failed update can happen when signing keys do not match. Do not uninstall the old version right away. First, confirm the right release was downloaded. Uninstalling can delete local app data, so it should happen only once the reason for the failure is clear.

Neither update managers nor Play Protect can promise a file is safe. Trusted sources and close attention to what is being installed are still the best protection.