To install an APK on Android, download it from the developer’s official website, allow your browser or file manager to install unknown apps when Android asks, then open the file and tap Install. The whole thing takes about a minute. The part that actually keeps you safe is where the file comes from, so most of this guide is about that.
We’ll use Spoofy, a free Tinder companion app that’s only distributed from sspoofy.com, as the running example.
Before you start: get the file from the right place
An APK is just an Android app packaged as a single file. Google Play installs them for you behind the scenes. When you install one yourself, you take on the job Play normally does: making sure the app is genuine.
The single most important rule is to download only from the developer’s official site. For Spoofy, that means sspoofy.com and nowhere else. Avoid:
- APK mirror and “mod” sites that repackage apps.
- Links in comments, DMs, Telegram groups or YouTube descriptions.
- Anything named like a “premium” or “unlocked” version of a known app.
Repackaged copies of popular apps are one of the most common ways Android malware spreads. They look identical to the real thing until they ask for permissions they don’t need.
Step 1: Download the APK
Open the official site in your phone’s browser, check that the address is right and starts with https, and tap the download button. Chrome may say the file type can harm your device. That’s a generic notice for every APK. Tap Download anyway if you’re on the official site.
Step 2: Allow installs from that app
On Android 8 and newer, permission to install apps is granted per app, not system-wide. The first time you open an APK, Android says your browser (or file manager) isn’t allowed to install unknown apps and offers a Settings button.
- Tap Settings in the prompt.
- Turn on Allow from this source.
- Go back, and the installer continues.
You can find the same switch later under Settings, Apps, Special app access, Install unknown apps. The wording differs a little between phone brands.
On older phones (Android 7 and below), there’s a single “Unknown sources” switch under Settings, Security. Spoofy needs Android 6 or newer.
Step 3: Install, and handle Play Protect
Tap Install. Google Play Protect may step in with a message that the app wasn’t scanned or is unknown to it. That’s normal for apps that aren’t on Google Play, and it happens to plenty of legitimate apps.
What to do depends on the source. If you downloaded from the official site, you can tap More details and then Install anyway. Play Protect may also offer to send the app for scanning, which is fine to accept. If you’re not sure where the file came from, cancel and download it again from the official site.
If Play Protect says an app is known to be harmful, don’t install it.
Step 4: Check what the app asks for
Once installed, an honest app asks only for permissions that match what it does. Spoofy asks for notifications, so it can tell you about new matches, messages and refilled likes.
Be very suspicious if an app you just sideloaded wants accessibility access, to be a device admin, or access to your SMS, unless that is clearly its job. Those are the permissions malware relies on. A Tinder companion app has no reason to request them. Our page on whether Spoofy is safe goes through what it does and doesn’t access.
Step 5: Turn the permission back off
After installing, go back to Install unknown apps and switch off your browser. It costs nothing, and it means a stray download can’t install itself later by accident.
Updating later
Sideloaded apps don’t update through Google Play. To update, download the new version from the same official site and install it over the existing app. Your settings and sign-in stay as they are.
If Android says App not installed when updating, the new file was usually signed by a different developer than the one already on your phone. That’s a safety feature. It often means one of the two copies didn’t come from the official site. Uninstall the unofficial one and use the official download.
Quick checklist
- Downloaded from the developer’s own website, over https.
- Unknown apps permission granted only to the app you used, and switched off afterwards.
- Play Protect warnings read, not just tapped through.
- No requests for accessibility, device admin or SMS from an app that doesn’t need them.
- Updates from the same site, installed over the old version.
How this applies to Spoofy
Spoofy is not on Google Play, so the Android version is installed exactly as described above, from sspoofy.com only. If you’d rather not sideload anything, there’s also a web app at app.sspoofy.com that works in any browser, including on an iPhone or a laptop. See our guides on Spoofy on iPhone and Tinder on PC.