Make a confident decision before you install

1Our safety philosophy

APKApps is not an antivirus, and we do not claim that listed files are "safe." What we do claim is that for every file we display, we surface enough information for an informed user to verify it independently. We choose transparency over reassurance — because reassurance you can't verify isn't real safety.

2The signals we publish

• PN
  Package nameThe unique reverse-DNS identifier (e.g. com.example.app).
• V
  VersionBoth the human-readable name and the integer version code.
• σ
  SHA-256 hashA 64-character fingerprint of the exact file bytes.
• ⚿
  Signing certThe certificate the developer used to sign the APK.
• ⚙︎
  Min/Target SDKThe Android API level range the app supports.
• ⚐
  PermissionsEvery Android permission the app declares.
• ⌛
  ProvenanceWhere the listing came from and when it was last updated.

3Why file hashes matter

A SHA-256 hash is a deterministic fingerprint of a file. Change a single byte of the APK and the hash changes completely. By comparing the hash of your downloaded copy with the one APKApps shows on the listing, you can confirm the file you have is the file we catalogued.

4Reading Android permissions

Permissions tell you what the app can ask for at runtime. They don't all run automatically, but they are the maximum set of capabilities the app could request.

Watch out for

• SMS / Call log access in apps that have nothing to do with messaging or calls.
• Accessibility service — extremely powerful; legitimate uses exist (password managers, screen readers), but malware also abuses it.
• Device admin / device owner — used for MDM and parental controls; rare for consumer apps.
• Install packages — lets the app install other apps. Reasonable for app stores, suspicious otherwise.
• Background location — tracking after you close the app.

5The signing certificate

Every Android APK is cryptographically signed. Once an app is installed, only an APK signed with the same certificate can update it. That means a developer's signing certificate becomes a stable identity over time — useful for spotting impersonation.

If the signing cert on a listing doesn't match the cert of an app you already trust, treat the new file with suspicion.

6Archive listings: extra caution

Archive entries have intentionally light metadata. They may not include screenshots, descriptions, or curator review. They exist so older or obscure builds remain accessible, but you should treat archive files with extra skepticism.

7Reporting an unsafe listing

If you believe an APK is malicious, mislabeled, infringing, or otherwise should not be available on APKApps:

• For safety / malware concerns → Report a Problem.
• For copyright / trademark issues → DMCA request.
• For anything else → contact us.

8What's next

We're working on additional verification layers — including third-party scan integration, signing-certificate fingerprint history, file reputation scoring, and richer manual review for high-impact listings. We'll continue to favor transparency and user control over opaque trust badges.