How to Check If an Android App Is Safe Before Installing It (2026)

No single badge can prove that an Android app is safe. A better approach is to combine several checks: where the app came from, who published it, what permissions it requests, what Google Play Protect reports and whether the app’s behavior matches its stated purpose.

This checklist is designed for normal Android users evaluating an unfamiliar app. It cannot guarantee that an app is risk-free, but it can help you identify obvious red flags before giving software access to your phone and data.

1. Start with the installation source

Apps from Google Play are reviewed through Google’s platform controls and Play Protect, but store presence is not a guarantee that every app will remain safe forever. Apps installed from websites, file-sharing services or third-party stores require more scrutiny because you are relying more heavily on the publisher and the source that hosts the APK.

If an APK is being distributed outside Google Play, verify that the download comes from the developer’s official site or another source you have a specific reason to trust. Avoid “modded,” “premium unlocked” or cracked packages unless you can independently verify both the software rights and package integrity.

2. Keep Google Play Protect enabled

Google says Play Protect scans apps from Google Play before download, checks devices for potentially harmful apps from other sources and can warn, disable or remove harmful software. It can also recommend scanning an unknown sideloaded app for a code-level evaluation.

Play Protect is enabled by default. You can review it from Google Play Store → profile icon → Play Protect. Google recommends leaving Play Protect turned on.

3. Read the Data safety section — but understand what it is

Google Play’s Data safety section lets developers disclose what data an app collects or shares and how it handles that data. It is useful for comparison, especially when two apps provide similar functionality with very different data practices.

However, the section is based on information supplied by the developer. Treat it as one signal, not as an independent security audit. Compare what the developer says with the permissions and behavior you actually see.

4. Check whether the requested permissions make sense

Android lets you review permissions by app and by permission type. Common sensitive permissions include camera, microphone, contacts, location, SMS, phone, photos and videos.

A permission is not suspicious simply because it is sensitive. Context matters. A camera app needs camera access. A wallpaper app requesting SMS access deserves more explanation.

On current Android versions, you may also be able to choose options such as “Allow only while using the app,” “Ask every time” or approximate rather than precise location. Use the narrowest permission level that still lets the app work correctly.

5. Use the Privacy Dashboard after installation

If you decide to install the app, Android’s Privacy Dashboard can show which apps accessed permissions such as location, camera or microphone and when that access occurred. That is useful for spotting behavior that was not obvious during installation.

6. Check the developer, not just the app name

• Does the developer name match the official company or project?
• Does the developer have a credible website and support contact?
• Are other apps in the account related and maintained?
• Does the privacy policy actually describe the app, or is it generic boilerplate?
• Is the package being promoted through suspicious messages or fake urgency?

Google specifically warns that scams can begin with unexpected messages that pressure users into downloading an app or changing restricted settings. Be especially cautious if someone you do not know tells you to install an APK, enable Accessibility, disable security checks or allow restricted settings.

7. Check update history and maintenance quality

An app that has not been updated for years is not automatically malicious, but old dependencies and abandoned code can create security and compatibility problems. Look for recent maintenance, clear release notes and developer responses to recurring issues.

8. Be cautious with Accessibility, SMS and notification access

Some legitimate apps need powerful access, but these permissions can also be abused. Accessibility services can observe or interact with on-screen content. SMS access can expose authentication messages. Notification access can reveal sensitive message previews.

If the feature you want does not clearly require that permission, stop and investigate before continuing.

9. Watch for behavior that does not match the listing

• unexpected full-screen ads outside the app
• browser redirects that appear without interaction
• requests to disable Play Protect
• new device-admin or Accessibility prompts
• unexplained battery or data usage
• new apps or shortcuts appearing without permission

If the app triggers behavior like this, remove it and run a Play Protect scan. For scam-specific risks, also see our QR code scam guide and dating-app romance scam warning signs.

A 60-second pre-install checklist

1. Confirm the source and developer.
2. Read recent reviews for recurring safety or billing complaints.
3. Check the Data safety section.
4. Review requested permissions.
5. Keep Play Protect enabled.
6. Reject unexplained Accessibility, SMS, admin or restricted-setting requests.
7. After installation, review Privacy Dashboard activity if the app uses sensitive permissions.

Official sources

• Google Play Protect
• Google Play Data safety
• Change app permissions on Android
• Android restricted settings and scam warnings

Featured image: Photo by Denny Müller on Unsplash.