Installing an APK from outside Google Play is normal for beta builds and small projects, but it is also one of the ways malware spreads. This is the short checklist I use myself, and the one I try to make easy for people who install my own app.

1. Start from the developer's own page

Open the download from the developer's official website or code repository, not from a file forwarded in a chat. Check that the address in the browser is the one the developer lists. If the only source is a random mirror, be careful.

2. Compare name, version and size

A real release page usually shows the version and the file size. If the file you downloaded is much bigger or smaller than listed, do not install it.

3. Check a hash if one is published

Some developers publish a SHA-256 hash next to the download. On Windows run certutil -hashfile app.apk SHA256 . On Linux or macOS run sha256sum app.apk . The result should match exactly.

4.…