How to Download an APK Safely

Downloading an APK directly means the safety checks that the Play Store runs automatically fall to you. This guide covers the five steps that matter: enabling unknown-source installs, downloading from a source that publishes a checksum, verifying that checksum, reviewing permissions, and closing the unknown-source door afterward.

1
Enable installs from unknown sources
Go to Settings > Apps & Notifications > Special App Access > Install Unknown Apps. Select the browser or file manager you use to download APKs and toggle Allow from this source. Enable this only for the app that will hold the file.
2
Download the APK file
Download from the app's listing page and keep that tab open. You will need the published SHA-256 hash, version number, and file size to compare against the file you just downloaded.
3
Verify the SHA-256 hash
Use a SHA-256 calculator app from Google Play, or transfer the file to a desktop and use shasum (macOS/Linux) or certutil (Windows). The hash must match exactly — a single differing character means the file was altered.
4
Review permissions before installing
Android shows a permission list before the install completes. A cricket, football, or game utility should not need contacts, SMS, accessibility, or device admin access. Stop if it asks for those.
5
Install, then re-check and lock the door
Complete the install, open the app once to confirm the permission list matches what you approved, then return to Settings and turn off Install Unknown Apps for that browser.