How to Check an APK for Malware Before Installing (2026)

If you are about to install an app from outside the Play Store, learning how to check an APK for malware first can save you from data theft, scam ads, and a compromised phone. The good news is that the most effective checks are simple and free. This guide shows you how, and pairs well with our guide on how to safely install an APK on Android.

Check APK for Malware, Step 1: Confirm the Source

The most powerful malware check happens before you download: verify the source. An APK from the Google Play Store is already scanned by Google. An APK from a developer’s official website is generally trustworthy. If the source is a random third-party “free APK” site — especially one offering modded or cracked apps — no scan can make it safe. Reject it outright.

Check 2: Use Google Play Protect

Google Play Protect is built into Android and scans apps, including many sideloaded ones, for known threats. Make sure it is enabled in the Play Store settings. When you install an app from outside the store, Play Protect can warn you if it detects something harmful. We explain this safety system in our Play Protect guide.

Check 3: Verify the App’s Signature and Package Name

Legitimate apps are digitally signed by their developer, and each has a unique package name. If an APK’s package name is slightly off from the official app, or its signature does not match the developer, that is a strong sign it has been tampered with. Comparing against the official Play Store listing is a quick sanity check.

Check 4: Scan the File With a Trusted Tool

You can upload an APK to a reputable online malware-scanning service, or use a well-known mobile security app from a trusted vendor, to scan it before installing. While no scanner is perfect, a scan from a reputable tool adds another layer of confidence for a file whose source you are unsure about.

Check 5: Watch the Permissions It Requests

Malware often demands permissions far beyond what the app needs — like a simple game asking to read SMS or access your accounts. Reviewing permissions before and after install is an easy way to catch suspicious apps. Our guide on Android app permissions explains what is normal and what is not.

The Simplest Rule of All

If checking an APK feels like too much work, that is actually a signal: for almost everyone, the safest path is to skip sideloading entirely and install the app from the Play Store, where Google handles verification for you. Manual checks are for the rare cases where you have a genuine, official reason to use a direct APK.

When you check an APK for malware, remember the source matters more than any single scan. To check an APK for malware effectively, always start by confirming it comes from an official place.

Conclusion

Knowing how to check an APK for malware gives you real protection, but the biggest safeguard is choosing a trustworthy source in the first place. Confirm the source is official, keep Play Protect on, verify the signature, scan with a trusted tool, and review permissions. Do that, and you dramatically reduce the risk of installing something harmful.