What Is an APK File? APK Meaning, Contents and Safety

What is an APK? APK meaning and definition

APK stands for Android Package, the file format the Android operating system uses to distribute and install apps. You will also see it expanded as Android Package Kit. Android Developers describes an APK as an archive file with an .apk suffix that holds what an app needs at runtime. When people talk about downloading APKs, they usually mean app files obtained outside the Google Play Store. APK files are made for Android; other operating systems, such as Windows or iOS, cannot install them directly.

Technically, an APK is a ZIP-format archive with a fixed internal layout and a digital signature. Each one identifies its app by a package name, also called the application ID, such as com.example.notes, plus a version code that rises with each release. Android uses the package name and the signature together to decide whether a file is a new app or an update to one you already have. It normally refuses an APK with an older version code over a newer installed copy, and older versions can bring back security bugs that later updates fixed.

What is inside an APK file: the APK file format

Unzip an APK and you will find a predictable set of parts:

AndroidManifest.xml: the manifest file, the app's declaration of its package name, components, the permissions it requests and the hardware features it needs. Inside the APK it is stored in a compiled binary form. Android's manifest overview explains each element.
classes.dex: the app's compiled code in Dalvik Executable (DEX) format. Larger apps add classes2.dex, classes3.dex and so on.
resources.arsc and res/: compiled resources such as screen layouts, images and translated text.
assets/: raw files the app reads as they are, such as fonts, data files or web pages.
lib/: native libraries compiled for specific processor types, in folders such as lib/arm64-v8a/, as the Android NDK documentation describes.
META-INF/ and the signing block: files for the original JAR-style signature live in META-INF. Newer signature schemes store the signature in an APK Signing Block that protects the whole file, as the Android Open Source Project explains.

An archive tool can open an APK, but not decode the manifest. Android Studio's APK Analyzer can.

APK vs Android App Bundle (AAB) and split APKs

An Android App Bundle, with the extension .aab, is a publishing format, not an install format: you cannot install one directly on a phone. Developers upload a bundle, and Google Play builds optimized APKs from it for each device configuration. Google Play has required new apps to publish this way since August 2021, according to the Android App Bundle documentation.

The result is split APKs: a base APK plus configuration APKs for screen density, processor type and language, installed together. That has practical effects:

An app on your phone may be several APK files, so copying only the base file to another device often fails.
Some download sites repackage split APKs into their own archive formats, such as .xapk, which need a separate installer app. That is one more program and one more source you have to trust.

Where APKs come from: Google Play and sideloading

Most people never handle an APK file. Google Play downloads and installs the right split APKs in the background, and device makers' own stores work in a similar way. Installing an app from anywhere else is called sideloading.

Developer websites: some companies offer a direct download, often with a published checksum.
Other app stores: each sets its own review rules.
Work devices: employers can push internal apps through device management.
Links and attachments: APKs sent by text message, chat, email or a pop-up ad are a common way malware reaches phones. Treat an unexpected one as hostile.

Google has also announced developer verification for apps installed on certified Android devices, starting in some countries in late 2026 with a wider rollout planned. Check that page for where it applies and what it means for sideloaded apps.

How to tell whether an APK is safe before you install it

No single check proves an APK is safe. Work through these in order, and stop at the first one that fails:

Source. Get the file from the developer's official site or a store you trust, reached by typing the address yourself. Skip modded or cracked copies of paid apps; they are a classic way to repackage malware.
Package name and version. Compare the package name with the official one. A Google Play listing shows it after id= in the web address. A lookalike name, or a version the developer never released, is a red flag.
Checksum. If the developer publishes a SHA-256 hash, compare it with your copy. On Windows, Get-FileHash uses SHA-256 by default; on Linux or macOS, use sha256sum or shasum -a 256.
Signing certificate continuity. Run apksigner verify --print-certs app.apk from the Android SDK and compare the certificate digest with an earlier version's or the developer's published fingerprint. Android normally accepts an update only when it is signed with the same key, or with a new key the developer rotated through a supported process, so a changed signer needs an explanation. Copies from Google Play may be signed with a key Google manages, so they can differ from the developer's direct download.
Permissions versus purpose. A flashlight has no reason to read text messages, use accessibility services, read your notifications or become a device administrator. Our guide to reading Android APK permissions and findings goes deeper.
Google Play Protect. Leave it on. Play Protect checks apps at install, including apps from outside Google Play, and can warn about, disable or remove harmful ones. Silence is not a guarantee.
Scanning. A malware scan catches known threats, and a static analyzer such as ASL X-Ray shows what the app appears able to do. Neither can prove an app is safe.

How to install an APK file on Android safely

On Android 8.0 and later, permission to install apps from outside the store is granted one app at a time, through a setting called Install unknown apps. Menu names vary by phone maker.

Download the APK and run the checks above before you open it.
Open the file from your Files app or your browser's downloads.
When Android asks, allow only that app, such as Files or Chrome, to install unknown apps. Do not grant it to messaging or social media apps.
Go back, tap Install, and read the permission requests when you first use the app. Deny anything the feature does not need.
Turn the permission off afterward: open Settings, then Apps, then Special app access, then Install unknown apps, and switch off the app you used.
Delete the APK from your downloads so it is not reinstalled by mistake.

On Android 7.1 and earlier, a single Unknown sources switch under Settings, then Security, does the same job; turn it off when you finish. Installing an APK file on the phone itself does not need USB debugging.

How to remove an app you installed from an APK

Sideloaded apps uninstall like any other app: open Settings, then Apps, choose the app and tap Uninstall, or press and hold its icon and choose Uninstall. Android Help also covers removing apps through the Play Store.

Uninstall is greyed out: the app may be a device administrator. Find the device admin apps list in your security settings, deactivate the app there, then uninstall it.
The app keeps reopening or hides its icon: restart in safe mode, which pauses downloaded apps on most phones, and uninstall it from there.
Afterward: check Accessibility and Notification access for leftover entries, check Google Play Protect in the Play Store, and change passwords for accounts you used while a suspicious app was installed, starting with email.

Where ASL X-Ray fits

ASL X-Ray is an APK analyzer for reviewing what an Android app can do before you install it. It reads the app file without installing, launching or emulating it. Its report covers what the app appears able to do, why each behavior was flagged, where in the file the evidence sits and how much of the app could actually be read. Ten of its 48 rules connect separate findings into named patterns, such as an app that draws over other windows while reading their content.

Every report states its coverage and says that static analysis cannot prove an app is safe. Compiled native libraries are counted, but their machine code is not read, and obfuscated code, encrypted payloads and code downloaded after installation are blind spots, so a low score is not a clean bill of health. The phone app, ASL X-Ray Lite, checks an app on the device itself and declares no platform permissions, including internet access. See how ASL X-Ray works.

Frequently asked questions

What does APK mean?

APK means Android Package, the file format Android uses to install apps. The file ends in .apk and is a signed ZIP-format archive that holds the app's manifest, code, resources and any native libraries.

Are APK files safe?

The format itself is neither safe nor unsafe. An APK is only as trustworthy as its source and its signer. A file from the developer or a trusted store, with a matching certificate and sensible permissions, is far lower risk than one sent in a message or a cracked copy of a paid app.

What is the difference between an APK and an AAB?

An APK is what a phone installs. An Android App Bundle (AAB) is what developers upload to Google Play, which turns it into optimized split APKs for each device. You cannot install an AAB directly.

Why won't my APK file install?

Common causes: an app with the same package name is installed but signed with a different key, the APK does not support your Android version or processor, it is only part of a split APK set, Play Protect blocked it, or a work policy forbids sideloading.

Can I open an APK file on a Windows PC?

You can look inside it with an archive tool or Android Studio's APK Analyzer, and check its hash and signature there. Running it takes an Android phone, tablet or virtual Android device.

Where do downloaded APKs go on Android?

Usually the Downloads folder, which you can open in your phone's file manager, often called Files or My Files. Delete the APK after installing; the installed app does not need it.

Related guides

Explore the complete product

Read features, current access and limitations

What Is an APK File? APK Meaning, Contents and How to Check One