APK files

An APK (Android Package Kit) is the file format Android uses to distribute and install apps. It is a single archive that contains everything an app needs to run on a device: executable code, assets, a manifest, and certificates. While most people get APKs through the Google Play Store, the file itself is just a container; the risk is never the format. It is where the file came from and whether its signing certificate matches the publisher.

What is inside an APK?

An APK is a ZIP archive with a specific internal layout. The Android system expects these components:

• AndroidManifest.xml, the app’s metadata, including requested permissions, activities, services, and the minimum and target Android versions.
• classes.dex, the executable code (Dalvik bytecode) that runs on Android’s runtime.
• resources.arsc, compiled resources such as strings, colors, and layouts.
• res/, raw resources like images, sounds, and XML layouts.
• assets/, additional files the app reads at runtime, such as fonts, data files, or HTML.
• META-INF/, the folder that holds the signing certificates and signature files for v1 (JAR) signing.
• lib/, native code libraries for different CPU architectures (armeabi-v7a, arm64-v8a, x86).

The manifest is the most security-relevant part: it declares the permissions the app requests and the components it exposes. Android Developers (2024) states that the manifest is required in every application.

When you download an APK from a third-party site, you are downloading a ZIP-like container. The Android system checks the APK’s signing certificate before installing it, and the certificate must match the key that signed the app’s previous version if an update is being installed. An APK signed with a different key than the installed app will fail with “app not installed” or a signature error, even if the package name is identical. This is a deliberate security measure: the signing certificate is the identity of the app, not the name.

The Android App Bundle difference

The Android App Bundle (AAB) is the publishing format for Google Play. It is not an installable file; Google Play uses it to generate optimized APKs for each device configuration. When you download an app from the Play Store, you receive a split APK or a set of APKs, not the AAB itself. Some developers distribute AAB files outside the Play Store, but these cannot be installed directly on a device.

How APK signing works

Every APK is signed with a certificate before installation. Android uses the signature to verify that the APK has not been modified and that updates come from the same developer. The signature does not identify a specific person or company; it only proves that the same key signed both the existing app and the new file. According to Android Developers documentation, a self-signed certificate is used, and the system trusts it only because the same key signed the app that is already installed (Android Developers, 2024). The Android system does not require a certificate from a public CA.

Signature schemes

Android supports three signature schemes, documented by Android Developers:

• v1 (JAR signing): signs individual files inside the APK. This is the legacy scheme and can be manipulated if the archive is modified and re-signed.
• v2 (APK Signature Scheme v2): signs the entire file contents, making it much harder to tamper with without detection. Since Android 7.0 (API 24), v2 is supported.
• v3: adds key rotation, so a developer can change signing keys over time without forcing users to uninstall. v3 is supported from Android 9 (API 28) onward (Android Developers, 2024).

The practical rule: an APK signed with v1 alone is easier to tamper with, and a v2 or v3 signature is the minimum you should trust from a non-store source.

How to check an APK before you install it

Do not install an APK from a source you do not trust. Before you sideload a file, take these steps:

1. Verify the source. Download the APK only from the developer’s official website or a recognised repository like F-Droid. If a site offers a paid app for free, or an app that is not open source but claims to be “modded,” stop.
2. Check the file hash. If the developer publishes a SHA-256 checksum, generate the hash of your downloaded file with a tool like sha256sum on Linux or certutil -hashfile on Windows. Compare every character. A mismatch means the file was altered or corrupted.
3. Inspect the requested permissions before installing. On Android, when you open an APK file, the system shows the permissions the app declares in its manifest. Read the list. A flashlight app that requests access to your contacts and SMS is a red flag.
4. Use an online scanner. Upload the file to VirusTotal. This runs the APK through multiple antivirus engines and shows whether any flag it as malicious. A clean result is not a guarantee, but a flagged result is a hard stop.
5. Check the signing certificate. You can view an APK’s certificate details with the keytool command (part of the Java Development Kit). Run keytool -printcert -jarfile app.apk in a terminal. Compare the certificate fingerprints against those published by the developer. If the developer does not publish fingerprints, you cannot verify this way, which increases your risk.

What to do when an APK will not install

If you see “app not installed” or a signature error, check these points:

• You already have a version of the app installed that was signed with a different key. Uninstall the existing app first, then install the new APK. You will lose the app’s data unless you back it up.
• The APK targets a newer Android version than your device runs. Check the minSdkVersion and targetSdkVersion in the manifest against your device’s Android version in Settings.
• The APK is corrupted. Verify the file size against the source and check the hash if one is available.

What to skip when sideloading

• Do not install APKs from shortened URLs on social media or messaging apps. You cannot inspect the destination before downloading.
• Do not ignore Play Protect warnings. If Play Protect flags an APK during installation, cancel the install and investigate the file before proceeding.
• Do not grant the “Install unknown apps” permission to apps that do not need it. After sideloading, revoke the permission from the file manager or browser you used.

What an APK is not

The file itself is not code that runs directly; it is a container. Android extracts and compiles parts of it at install time. The signing certificate is a digital certificate embedded in the file; it proves that the APK was signed by the same key as previous versions, not that the developer is a known company. A self-signed certificate is normal for Android apps. A signature is not proof of a developer’s identity in the legal sense; it proves cryptographic continuity. The Android documentation (Android Developers, “App signing”, 2024) states that all apps must be signed, and that the system rejects an update if its signature does not match the installed app’s signature.