📖 Guide · Updated 10 Nov 2026
How to Install an APK on Android Safely
Step-by-step guide to installing an APK file on Android: the 'install unknown apps' setting on every Android version, how to verify the SHA-256 hash, and how to stay safe.
What an APK file is
An APK (Android Package Kit) is the file format Android uses to install apps. When you install something from an app store, the store quietly downloads an APK and installs it for you. Installing an APK yourself — sometimes called sideloading — simply means you handle that download step manually, which is how most free and open-source apps are distributed outside the big stores.
Sideloading is a normal, supported Android feature, not a hack. Done carefully, it is perfectly safe. The two things that keep it safe are downloading the file from a trustworthy source and checking that the file you received is the genuine release — both covered below.
Before you install
First, download the APK only from the developer's official website, their official GitHub releases page, or a curated catalogue such as F-Droid. Avoid random 'APK download' sites that re-upload files, because a re-uploaded file can be altered. Second, check the app's stated Android requirement against your phone: an app that needs Android 10 will not install on Android 8.
If the publisher provides a SHA-256 hash for the file, verify it before installing (see the verification section below). It takes a minute and proves the file was not changed in transit.
Step by step: installing the APK
1. Download the APK file with your browser or file manager. 2. Tap the downloaded file (in your notifications or in the Downloads folder). 3. The first time you do this, Android will say that your browser or file manager is not allowed to install apps. Tap 'Settings' on that prompt and switch on 'Allow from this source' (on some phones this is called 'Install unknown apps'). 4. Go back and tap the file again, review the permissions shown, and tap 'Install'. 5. When it finishes, tap 'Open' to launch the app.
On Android 8 and newer, this permission is granted per app — you allow your browser or file manager to install, rather than opening the phone up globally. On Android 7 and older there is one global switch instead: Settings → Security → 'Unknown sources'. Either way, the flow takes under a minute.
Verify the SHA-256 hash
A SHA-256 hash is a fingerprint of the file: change even one byte and the fingerprint changes completely. Many developers and catalogues publish the hash next to the download. To check it, open a hash or checksum tool (several file managers show a file's checksum under Properties), select the downloaded APK, and compare the SHA-256 value character for character with the published one. If they match, the file is exactly the file that was published.
On this site, every APK we host ourselves shows its SHA-256 next to the download button, and every other app links straight to the official source, so you can always cross-check.
After installing
Once the app is installed, go back to Settings → Apps → Special access → 'Install unknown apps' and switch the permission off again for your browser or file manager. You can turn it back on in seconds next time, and leaving it off means nothing can even attempt an install without you noticing.
Finally, keep the app updated. Open-source apps obtained from F-Droid update automatically through the F-Droid app; apps you installed from a direct APK need a fresh download of each new version — the version history on each of our app pages makes that easy to follow.