How to Check if an APK Is Safe Before You Install It

No single check can prove that an APK is harmless. What you can do is stack several quick, sensible checks so that most problems are caught before the file ever reaches your phone's storage as an installed app. None of the steps below needs technical skills, and together they take only a few minutes.

The aim is not to make you suspicious of everything. It is to give you a routine, so that when something does look off, you notice.

1. Start with the source

Where a file comes from matters more than anything else you can check afterwards.

• Prefer the developer's own website or a directory that tells you exactly where each file comes from. MODZILO lists each file's download source and security review status, which lets you see this at a glance.
• Be wary of pages that push you around. Several redirects, fake "Download" buttons, countdown pages or pop-ups asking for notification permission are all signs that the page cares more about clicks than about you.
• Check the address bar. Look-alike domains with small spelling changes are a common trick.
• Avoid files sent in chats or emails from people you do not know, even if the file name looks familiar.

2. Sanity-check the file size

Before or right after downloading, compare the size of the file with the size shown on the download page.

• A file that is much smaller than expected may be a downloader that fetches something else once installed, or simply a broken download.
• A file that is much larger than expected may include extra components you did not ask for.
• Small differences are normal between versions, and some pages round sizes. A difference of several times the listed size is the thing to worry about.

If the numbers do not match and the page gives no explanation, delete the file and look for a better source.

3. Look at the permissions

Android shows you what an app asks for, and those requests tell you a lot. Some file managers and APK inspection apps can show permissions before installing; otherwise, review them carefully the first time the app runs.

Ask one question for each permission: does this app need it to do what it says? A photo editor needs access to your photos. A calculator does not need your contacts.

Red flags worth stopping for:

• Accessibility service access requested by an app that has nothing to do with accessibility. This permission can read and control what is on your screen.
• Device admin requests, which can make an app hard to remove.
• SMS and call log access in an app unrelated to messaging or calling.
• Display over other apps combined with requests for your login details.
• Pressure to grant everything at once before you can use the app at all.

When an app insists on a permission it clearly does not need, that is reason enough to uninstall it.

4. Scan the file with VirusTotal

VirusTotal is a free service that checks a file against many antivirus engines at the same time. You can upload the APK from your phone's browser, or check it on a computer.

1. Open VirusTotal in your browser.
2. Choose the file tab and select the APK you downloaded.
3. Wait for the results, then read the summary and the list of engines.

Interpreting the result takes a little judgement:

• Zero detections is a good sign, but not a guarantee. New threats may not be recognised yet.
• One or two engines flagging a modified app with a generic label (words like "riskware", "PUA" or "unsafe") can be a false positive. Modified apps often trip heuristic rules simply because they have been changed from the original.
• Several engines agreeing, or any detection naming a trojan, spyware, banker, dropper or backdoor, is a stop sign. Do not install the file.

If you are unsure, it is always fine to choose not to install.

5. Keep Play Protect on

Google Play Protect can scan apps that come from outside the Play Store as well as those from it. Leave it switched on and let it scan new installs when it offers to. If it blocks an app or warns that the app is harmful, treat that warning as serious. Some warnings about modified apps are cautious by design, but that is a reason to double-check the source, not to switch protection off.

6. Test on a secondary device or profile

For an app you are not sure about, install it somewhere that does not hold your main accounts:

• An old phone you no longer use day to day.
• A separate user profile or a work profile, if your phone supports it. The option is usually under Settings → System → Multiple users, although the location differs on Samsung, Xiaomi and other brands.
• Some phones offer a "second space" or "secure folder" that keeps apps and data apart.

This way, if the app misbehaves, your main messages, photos and banking apps are not exposed.

If something feels wrong

Trust your instincts. If an app behaves oddly after installing, act quickly:

1. Turn on airplane mode to cut its network access.
2. Uninstall the app. If it will not uninstall, check Device admin apps in Settings and remove its admin rights first.
3. Run a Play Protect scan from the Play Store.
4. Change passwords for any account you signed in to through the app, starting with email, and enable two-step verification.
5. Check your accounts for sign-ins you do not recognise.

Key takeaways

• The download source is your most important check.
• File size and permissions quickly reveal many problems.
• In VirusTotal, one generic flag on a modified app may be a false positive; multiple detections or trojan-type names mean stop.
• Keep Play Protect on and test unfamiliar apps away from your main accounts.
• When in doubt, do not install.