How to tell whether an APK source is safe

Aktualisiert 2026-10-20

Artikel auf Englisch

An APK is only as trustworthy as the key that signed it. Open-source projects publish a consistent signing certificate; if a mirror's build has a different signer, it was rebuilt by someone else.

Check permissions before installing. A TV launcher has no business requesting SMS or contacts. An IPTV player should not need your location.

Mirror sites earn money by wrapping free APKs with ad SDKs. The app still works, so users do not notice. Prefer the project's own release page even when it is less convenient.

So wird es installiert

1. Compare the APK's signer against the project's published certificate: apksigner verify --print-certs app.apk
2. Read the permission list in the install dialog.
3. Confirm the package name matches the project's documented name.
4. If any of the three disagrees, do not install.