Updated October 4, 2026
How to Verify an Android APK Before Installing It
A practical checklist for checking an Android APK's publisher, permissions, source, and device protections before installation.
How to verify an Android APK before installing it
Sideloading an APK bypasses the Play Store's screening — so the verification job falls on you. Here's how to do it properly before tapping install.
The checklist
- Source: get APKs only from the developer's own site or a reputable mirror with signature verification (like APKMirror's signature checks). Random blogs and Telegram channels are out.
- Signature match: the APK's signing certificate should match the developer's other releases. A mismatched signature means a repackaged app — walk away.
- Permissions preview: check what the APK requests before installing. A flashlight app wanting SMS access is a no.
- VirusTotal scan: upload the file to VirusTotal for a multi-engine scan. Not perfect, but catches known malware.
- Version sanity: compare the version number and release date against the developer's official changelog. "v99.0" of an app that's really on v12 is fake.
After installing
Watch what the app actually does — unexpected battery drain, pop-up ads outside the app, or new device-admin requests are red flags. Keep Play Protect enabled even for sideloaded apps, and review what the permissions mean. Our installation checklist covers the full flow. Independent guide.