To sideload an Android app safely, get the APK only from the publisher's official page, verify the published hash, grant the install permission to one app for one install, review the permission prompts, then plan how you will update it. Skip any step and you are trusting a file you cannot vouch for.
The checklist
1. Start from the official page. Type the address yourself or use a bookmark. Do not follow a link from a message, a forum or a search ad. The publisher's page is the only place where the hash and file are guaranteed to match.
2. Confirm the file name and size. Compare with what the page lists. For example, the Safeguard download page lists Safeguard-1.0.2.apk at about 69 MB. A file that is much smaller or larger is suspicious.
3. Verify the SHA-256. Compute the hash of your download and compare it with the published value in full. A truncated comparison is a weak check, and a single changed character means a different file.
sha256sum app.apk
4. Use a clean path. Download on a computer if you can, verify, then transfer. This also lets you keep the file for your records.
5. Grant install rights narrowly. Android asks you to allow installs from the app you used to open the file, such as your browser. Allow it for that one install.
6. Read the prompts. On first run, note every permission request. Deny anything unrelated to the app's job.
7. Turn the install permission off. Go back to settings and revoke it for the browser or file manager. A standing permission to install unknown apps is the opening malware relies on.
8. Plan updates. Sideloaded apps often do not update through the store. The Safeguard page says APK updates come from the download page, not Google Play. Set a reminder and repeat the checklist for each new version.
Red flags
- A download page with no hash.
- A hash posted only beside the file on a third party site.
- Instructions to disable built in protections beyond the install permission.
- An app that asks for broad access with no stated reason.
For teams
Record the version and hash you approved in a shared document. When a new version arrives, approve it again. For managed fleets, use your device management tool to distribute the approved file rather than letting people download their own.
When not to sideload
If the app is on Google Play and your device supports Play, use Play. You get automatic updates and fewer manual steps. Sideloading is for cases where Play is unavailable or policy requires a specific file.
Quick check
Is checking the hash enough?
It proves the file matches the published one. It does not prove the publisher is trustworthy, so only trust hashes from the official page.
Sources
Last reviewed: 19 October 2026.
