How to check if an Android app is safe before you install it
The store listing won't tell you if an app leaks data or ships known vulnerabilities. Here's what to actually check — permissions, trackers, and a real exposure scan.
Last updated 2026-09-05
Read in context. These instructions need to be adapted to your app and platform version. New scans provide static detections; they do not establish current backend access. Current methodology.
Start with the store signals
Install count, review quality, the developer's other apps, and how recently it was updated are useful context — but they're necessary, not sufficient. Popular, well-reviewed apps ship serious exposures all the time.
Check permissions and the data-safety label
Look at what the app requests versus what it plausibly needs. A flashlight app asking for contacts and location is a red flag. Compare the Play Data Safety label against the app's category — and be aware labels are self-reported and are sometimes inaccurate.
Check the trackers
Many apps embed advertising and analytics SDKs that collect identifiers and behavior. That's a privacy consideration even when the app is otherwise "safe."
What listings can't show you
A store page never reveals the things that actually leak your data: hardcoded API keys, publicly readable databases, weak app signing, or bundled libraries with known CVEs. These are only visible by analyzing the app package itself.
Scan it for real exposure
apk-scanner.com provides static findings, build details and analysis coverage. Scans check whether a referenced backend answers an unauthenticated request, never using a detected credential and never reading stored data. Review the current methodology and each report’s limitations.
Frequently asked questions
Can an app on Google Play still be unsafe?
Yes. Play review catches malware and policy violations, but not most data-exposure bugs — leaked keys, misconfigured cloud storage, weak signing and vulnerable dependencies routinely ship in legitimate apps.
Which permissions are red flags?
Any permission that doesn't match the app's purpose — SMS, accessibility service, device admin, all-files access, or background location in an app that has no obvious need for them.
Is a high star rating a guarantee of safety?
No. Ratings measure user experience, not security. A five-star app can still leak data or ship a critical vulnerability.