APK Files: What They Are and How to Judge One Before Installing

An APK is just an Android app in a single file. That makes it easy to share, and just as easy to tamper with. Here is what to check.

What an APK is

An APK, or Android Package, is the file format Android uses to distribute and install apps. It bundles the app's code, resources and a manifest that declares, among other things, which permissions the app wants. When you install from a store, an APK or a related format is still involved; you just never see the file.

Why APKs from the web carry more risk

Android apps are digitally signed. Code signing lets the system confirm that an app has not been altered since its developer signed it and that updates come from the same signer. The catch is that anyone can sign an app with their own key. A modified copy of a popular app, re-signed by someone else, will install normally on a phone that has never had the original. That is a common way mobile malware spreads: a familiar-looking app with extra code added.

Checks before you tap install

• Source. Get the file from the developer's own site, reached by typing the address, not from a link in a chat, an ad or a comment.
• Mirror sites. Third-party download sites repackage files. Some are careful, many are not, and you cannot easily tell which.
• "Mod" or "unlocked" versions. An app with paid features removed for free has, by definition, been altered by someone other than the developer.
• Permissions. Android shows requested permissions during or after install. Compare them with what the app does; see reading app permissions.
• Installer prompts. If a downloaded app immediately asks for accessibility access or to become a device administrator, stop.

Gaming and betting apps are a common case

Some categories of app are frequently handed out as APK downloads rather than through stores, and real-money gaming is one of them, because store rules on gambling vary by country. That means people are often asked to sideload exactly the kind of app that will later handle deposits and withdrawals. Before installing anything like that, it helps to read what the service's terms say about money, not only how the app looks. As an example, a Traditional Chinese review page sets out withdrawal, trial-credit and first-deposit terms for one gaming brand (必贏娛樂城); whichever service you are considering, look for that kind of information first, and still apply every file check above.

After installing

1. Turn the "install unknown apps" permission off again for the browser or file manager you used.
2. Keep the device's built-in malware scanning switched on.
3. Remember that sideloaded apps may not update automatically. An app you never update becomes less safe over time.

If you cannot say who built the file and where it came from, the safest choice is not to install it.

Version checked 2026-11-09 · Rafael Duarte