How to Check If an APK Is Safe Before Installing (7 Checks)
Last verified: October 14, 2026
No single check can prove an APK is 100% safe. Safety comes from layering several quick checks before you tap Install. If you only do one thing, make it the first check on this list: where the file came from matters more than anything else.
1. Start with the source
The safest APK is one you got from the app’s own developer — their official website, their GitHub releases page, or their listing on Google Play. Reputable mirrors that verify signatures (and publish the developer’s original signature) are the next-best option.
Walk away from:
- Random download sites you’ve never heard of
- Any APK advertised as “mod,” “premium unlocked,” “cracked,” or “free pro version” — these are repackaged apps, and repackaging is exactly how malware gets inserted
- Links from social media comments, messaging groups, or pop-up ads
If you want the full version of this step, see our guide on checking an app’s source before installing.
2. Match the package name and developer
Every Android app has a package name — a unique ID like org.videolan.vlc for VLC. Before installing an APK:
- Compare the package name with the one on the app’s Google Play listing. If they don’t match, it’s not the same app.
- Check the developer name. Typosquatting is common: “VideoLan” instead of “Videolabs,” or a slightly different logo, means a copycat.
- Be suspicious of apps that imitate a popular app’s name and icon but come from an unknown developer.
3. Check the signature
Android requires every APK to be signed by its developer. A legitimate update always carries the same signature as the previous releases from that developer. A repackaged or tampered APK will have a different signature.
In practice:
- If the developer publishes SHA-256 hashes of their releases, compare the hash of the file you downloaded. A mismatch means the file was altered.
- Otherwise, use a signature-checker app to compare the signature of the new APK against an older version you already trust. If the signature changed, don’t install it.
4. Scan it with VirusTotal
VirusTotal scans a file with dozens of antivirus engines at once. Upload the APK before installing it.
How to read the result:
- Zero detections: a good sign, but not a guarantee — no scanner catches everything.
- One or two detections: often a false positive, especially on legitimate tools that use powerful features. Treat it as a yellow flag, not a verdict.
- Several detections across different engines: don’t install it. Find another source.
VirusTotal is free and you don’t need an account to scan a file.
5. Keep Google Play Protect switched on
Play Protect scans apps from outside Google Play too, not just Play Store downloads. When you install an APK, it checks the app and warns you if it looks harmful. Keep it enabled — it costs nothing and runs automatically.
See our guide on keeping Google Play Protect switched on for the exact setting.
6. Read the permissions before installing
Android shows you what an app wants access to during or just after installation. Compare the request against what the app actually does. See our guide on understanding app permissions before installing for the full breakdown.
Red flags:
- A flashlight, wallpaper, or calculator app asking for Accessibility, SMS, or Device Admin access
- A simple media player asking for contacts or call logs
- “Install unknown apps” permission requested by an app that has no reason to install other apps
Legitimate apps sometimes need broad permissions — a backup app genuinely needs file access. The question is always whether the permission matches the job.
7. Sanity-check the version, size, and age
Compare the APK against the official listing:
- A “new update” of a popular app that appeared days before the official release is probably fake.
- A file size wildly different from the Play Store version (much smaller or much bigger) suggests something was added or stripped.
- An app with no version history, no changelog, and no developer website behind it deserves extra skepticism.
If a check fails
Don’t install the file. Delete it and get the app from the developer’s official source instead. No app is worth a compromised phone.
If you already installed a suspicious APK
- Uninstall it immediately.
- Go to Settings → Apps and revoke any permissions it held, especially Accessibility, SMS, and Device Admin.
- Run a Play Protect scan.
- If the app could have reached sensitive accounts (banking, email, messaging), change those passwords from a different, clean device.
- Watch for unusual behavior — battery drain, pop-ups, or apps you didn’t install — for the next few days.
Quick checklist
- Source is the developer or a reputable mirror
- Package name and developer match the official listing
- Signature matches previous releases (or published hash)
- VirusTotal scan is clean
- Play Protect is switched on
- Permissions match what the app does
- Version, size, and age look normal
FAQ
Can an APK be safe if VirusTotal says it’s clean?
Mostly, yes — but no scanner catches everything. A clean scan plus a trustworthy source and matching signature is a strong combination. A clean scan alone is not.
Is it safe to install APKs from well-known mirrors?
Reputable mirrors that verify signatures are far safer than random sites. Still run the checks above — a mirror is only as good as its verification process.
Does Play Protect catch every bad APK?
No. Play Protect is one layer, and it misses things. That’s why you combine it with source checks, signature checks, and a VirusTotal scan.
What should I do if I already installed a suspicious APK?
Uninstall it, revoke its permissions, run a Play Protect scan, and change passwords for any sensitive accounts it could have reached.
Do I need an antivirus app to check APKs?
Not necessarily. VirusTotal plus Play Protect covers most cases for free. A reputable antivirus app is optional extra protection, not a requirement.
This article is informational guidance. It doesn’t guarantee any individual file is safe — when in doubt, get the app from the developer’s official source.