Open the settings menu on most Android phones sold in Australia and you’ll find a toggle that says something like “install unknown apps.” Tap it and a warning appears, usually in red, implying you’re about to do something reckless. So is sideloading Android apps actually dangerous, or is Google just being precious about its app store cut? The honest answer is both, depending on what you’re installing and from where.
Sideloading, for anyone who hasn’t hit that menu yet, just means installing an app without going through the Google Play Store. You download an APK file (Android’s equivalent of an installer) from somewhere else and tell your phone to run it directly. It’s been part of Android since the start, which is one of the genuine differences between Android and iPhone, where Apple still controls almost everything that lands on the device.
Why sideloading exists in the first place
Android was built on an open model. Google wanted manufacturers like Samsung, Oppo and Google itself to be able to customise the operating system, and it wanted enthusiasts to be able to install software the Play Store didn’t carry. That’s still true today: sideloading is how you get emulators, some banking-adjacent utility tools, F-Droid’s open-source app catalogue, or an APK of a regional app that never made it to the Australian Play Store listing.
It’s also, less glamorously, how a lot of malware gets onto people’s phones. Both things are true at once, and that’s really the whole article in two sentences.
When it’s genuinely fine
Our take, after years of watching this play out in the review queue: sideloading is low-risk when you can answer three questions clearly. Do you trust the source? Is the app widely known and discussed elsewhere, even if it’s not in Play Store? And are you prepared to lose the data on that app if something goes wrong?
Examples we’re comfortable with. Installing F-Droid, a long-running open-source app repository, to grab apps that Google’s commercial terms exclude. Sideloading a retailer’s own loyalty app when the Play Store listing is temporarily broken, but you’ve downloaded it straight from the retailer’s official website. Grabbing a regional streaming or banking app while travelling, when the Australian Play Store won’t show it but you can verify the publisher’s domain matches the company.
Tradies sideload more than most people realise, often without thinking of it that way. Specialised job-costing tools, niche measurement apps, or software a supplier emails out directly rather than publishing on Play Store. If the file comes from a known business with a real ABN and a website that’s been around for years, the risk is closer to normal internet use than anything exotic.
When it genuinely isn’t fine
Here’s where we’d push back on the “sideloading is basically safe if you’re careful” line some tech sites run. We don’t think that’s quite right, and it’s the mildly unpopular opinion we’ll actually defend: for most ordinary users, sideloading from a forum post, a random “mod APK” site, or a link in a Facebook group chat is a genuinely bad idea, full stop, not just a theoretical risk.
The scams here aren’t subtle once you know the pattern, but they work precisely because people don’t. A modified version of a popular game or streaming app, promising free premium features, bundled with code that reads your SMS messages or screen-records your banking app. We’ve seen this reported repeatedly through the Australian Cyber Security Centre’s public advisories, and the pattern lines up with what Australians report to Scamwatch: fake banking and investment apps distributed outside Play Store, often pushed through social media ads or messaging apps rather than search.
The giveaway features are consistent. The app asks for accessibility permissions it has no legitimate reason to need (that permission lets an app see and control almost everything on screen, which is exactly why screen-reading malware abuses it). It asks to be installed from a link in a text message, which echoes the pattern discussed in our piece on scam calls and robocalls in Australia, where the delivery method matters as much as the content. Or the file arrives with a name that doesn’t match the publisher at all, something a careful glance at the Play Store listing would have caught in ten seconds.
What Play Store protection actually does and doesn’t do
Google scans apps before they go live and runs Play Protect in the background on Android phones, checking installed apps (including sideloaded ones) against known malware signatures. It’s genuinely useful, and we’d never tell anyone to switch it off. But it isn’t absolute. Play Protect catches known threats; it’s slower against brand-new malware variants, and it can’t evaluate whether an app’s business model is dodgy rather than technically malicious. A scam investment app that behaves exactly as advertised, and simply steals your money through social engineering rather than code, sails straight through.
That’s worth sitting with for a second, because it changes the advice. The protection built into Android is about code behaviour, not about whether the business behind the app is legitimate. Due diligence on the publisher still sits with you.
Different buyers, different risk tolerance
Students juggling multiple devices and sharing tips in group chats are, in our experience, the group most likely to sideload casually, often for cracked versions of paid apps or study tools their university hasn’t licensed properly. We’d steer clear of anything promising a paid app for free; it’s the single most common lure in the malware reports we see cited by the ACSC.
Parents setting up a phone for a teenager are usually better off avoiding sideloading entirely on that device, partly because of malware risk and partly because of the kind of apps it tends to be used for. With the eSafety Commissioner’s social media minimum age rules now in force, some younger users go looking for sideloaded versions of apps to dodge age checks, which rather defeats the purpose and introduces exactly the malware risk this article is about. We’d treat that as a hard no in any family device policy.
Travellers have the most legitimate day-to-day use case, frankly. Regional transit apps, local payment apps, or services that geo-restrict their Play Store listing to a particular country are common enough that most seasoned travellers have sideloaded something at some point. The trick is doing it from the company’s own verified website rather than a third-party “APK mirror” site, many of which repackage legitimate apps with extra code baked in.
A short, sane checklist before you tap install
We don’t love bullet lists for their own sake, but this genuinely is list-shaped, so here it is.
- Check the publisher’s own website links directly to the APK, rather than finding it through a search result or forum post.
- Look at what permissions it asks for during setup, and be suspicious of accessibility access for anything that isn’t a screen reader or accessibility tool.
- Leave Play Protect switched on regardless of where the app came from; it’s not perfect but it’s not nothing either.
If an app fails any of those three tests, our advice is to walk away, even if a friend swears by it. The inconvenience of not having one extra app is nothing compared with the hassle of a compromised banking app, something our home network security checklist touches on from the router side of the same problem.
Why this matters more on some phones than others
Here’s a less obvious angle worth raising. Phones that get security patches for longer are meaningfully safer places to experiment with sideloading, because the underlying operating system is getting fixes for the vulnerabilities that malware exploits. A current Pixel or Galaxy flagship with several years of promised updates ahead of it is a more forgiving environment than a three-year-old budget phone that stopped receiving security patches a year ago. We’ve made this point before in our Samsung Galaxy S26 Ultra review: long software support isn’t a spec-sheet nicety, it’s closer to a safety feature, and it quietly determines how much risk any sideloading decision actually carries.
If you’re on an older phone that’s fallen out of the update cycle, we’d be considerably more cautious about sideloading anything beyond apps from extremely well-known, long-established sources. The phone simply has fewer defences left.
Our verdict on sideloading Android apps: selectively, not never
Sideloading isn’t the digital equivalent of leaving your front door unlocked, and we think Android’s openness is worth defending rather than apologising for. It’s also not a free pass. Our actual position, the one we’d argue with anyone over a coffee, is that the “never sideload, ever” advice some corners of the internet give is overcautious and a bit patronising, while the “sideload whatever, Play Protect’s got you” crowd is being naive about how scams actually work in 2026.
The middle path is boring but it’s the right one: know the publisher, check the permissions, keep your phone’s security patches current, and treat any APK arriving via a text message or a stranger’s forum post as something to delete, not install. Do that, and sideloading is just another normal part of owning an open platform. Skip it, and you’re relying entirely on luck.
— Priya Raman, Reviews Editor, Tech Geek
Featured image: AI-generated illustration.
