APK Download Safety Checklist Before You Tap Install
Most APK safety advice is a single tip repeated across dozens of pages. This is the full sequence in order, from before you download to after the app is running, with the reasoning for each step so you can judge when it applies.
Before the File Finishes Downloading
Confirm the source domain matches the developer or a listing you already trust, and check the file size against what the listing states; a file that is dramatically smaller or larger than expected has usually been repackaged or is incomplete.
Before Tapping Install
Compute SHA-256 on the downloaded file and compare it against the published hash. Run apksigner verify or an equivalent tool to read the signing certificate digest, and compare that against the installed copy if you're updating an existing app.
Scan the file with Play Protect before opening it. This step is often skipped because it feels redundant with the checksum, but Play Protect checks against a live threat database rather than a static value, and it catches different problems than a checksum does.
After Installing, Before Trusting It
Review the permission list on first launch rather than tapping through prompts. A permission with no connection to any feature you can identify in the app is the strongest single signal that something is wrong, stronger than the checksum or signature checks combined.
Frequently Asked Questions
Is a checksum match enough to trust an APK?+
No. A checksum only proves the file matches what was hashed, which could be a repackaged build if the attacker computed the hash after modifying the file. Signature verification and a permission review both check things a checksum cannot.
Do I need to check the signature if I already checked the checksum?+
Yes, they answer different questions. The checksum confirms the file wasn't corrupted or partially downloaded. The signature confirms who built it. A repackaged APK routinely passes a checksum check against its own tampered hash while failing a signature comparison against the original.
What permission requests should make me stop the install?+
Any permission with no visible connection to the app's stated features, especially device admin, accessibility service, or SMS access on an app that is not a messaging or accessibility tool. These are the permissions most commonly abused for persistence and data theft.
Is Play Protect enough on its own without a manual checksum check?+
No. Play Protect catches known threat signatures and behavioral red flags, but a targeted or newly repackaged build may not yet be in its database. Checksum and signature verification catch cases Play Protect has not seen yet.