I have downloaded many apps outside the Google Play Store. It is usually easy, but I have to make sure that the app is real and trustworthy. There are so many fake or modified apps online.
Also, after the apps are on my phone, they don’t update automatically as they do from the Google Play Store. So I would have to go and look on a bunch of different websites to see if there is an update.
I am now more mindful of where I source my APKs, as well as the apps’ signatures. I’ve even started using tools like Obtainium for updates.
These methods haven’t eliminated all of my risks, but they have improved the decisions I make.
I don’t download APKs without checking their source
The checks I make before installing an APK
When I find an APK I want, I first look at the developer’s website or the official release page. Even if a site offers the app, you can’t always tell who uploaded it or if the file is safe.
Some developers use F-Droid; others use app stores such as GitHub. I like these sources because I can see who made the app and find release details.
I’m especially careful with sites that offer modified or unlocked versions of popular apps. Free premium features might sound tempting, but I can’t know what was changed in the original app. A modified APK could have unwanted code or ask for permissions it shouldn’t need.
Even when I recognize the website, I don’t assume the download is safe. I still check whether the file matches the developer’s version.
With APK Analyzer, I can open a downloaded APK and check its signing certificate, permissions, version info, and other details before installing.
I also keep Google Play Protect on. It scans every app on my phone, including ones not from the Play Store, and lets me know if there’s anything harmful. To check that it’s working, I open the Play Store, tap my profile, and choose Play Protect. I also check that the Improve harmful app detection is enabled.
I use update managers to keep sideloaded apps current
How Obtainium and APKUpdater find new versions
Keeping track of updates is one of the things. One thing I don’t like about sideloading is tracking updates. I could check every developer’s website for new releases, but that’s not fun.
Update managers make it easier to keep track of my apps. One of those is Obtainium, which provides direct links to F-Droid, GitHub, and others. I can add an app using its release page, and Obtainium checks that source for newer versions.
I no longer have to remember all the different websites. Now, I can check for updates in one place. The developer’s update can be verified using a signing certificate.
Android allows apps to update if they are signed with the same key as the currently installed version. I do not recommend installing new apps if the developer does not explain why their signature differs from the one used to sign the previous version. I usually refer to the developer’s notes on their latest release for more information on the new signature.
However, I prefer Obtainium when I want to follow an app’s original release source. APKUpdater is another option if I want to check several supported repositories.
Whichever one I use, I still check the update’s source before installing it. Finding an updated APK doesn’t automatically mean it’s the right one.
Sideloading still requires a little caution
Don’t assume every APK is safe because Android allows it
Android doesn’t let every app install APKs without permission. I have to allow the app.
I have to allow the app I’m using, like my file manager, to install from unknown sources. I can turn off that permission when I’m finished.
I check its source, and review the permissions it’s asking for. Any app asking for access to my contacts or text messages for no obvious reason makes me pause before I think about installing it.
Updates need the same care. If an APK can’t update an app on my phone because the signing keys don’t match, I don’t uninstall the old version right away.
First, I check if I downloaded the correct release. Since uninstalling can delete local data, I only do it when I’m sure why the update failed.
Sideloading is safer when I know what to look for
Installing APKs allows me to use apps that aren’t on the Play Store. All I need to do is be a bit more careful about where I get them from and how I update them.
Checking the developer’s release page, verifying signatures, and keeping Play Protect on are good first steps. Obtainium and APKUpdater also save me from checking lots of websites when I want to see if an app has a new version.
Neither Update Managers nor Play Protect can promise that every file is safe. But when I stick to trusted sources and pay attention to what I’m installing, I can sideload apps with more confidence.