How to allow installs from unknown sources on Android

It is per app since Android 8

Older Android had one global switch called Unknown sources. Since Android 8 the permission belongs to the app that opens the package: your browser, your file manager or a dedicated installer. The first time one of them tries to install something, Android shows a dialog with a Settings button that leads straight to the right switch. You only need to do this once per installing app.

Finding the switch by hand

Stock Android and Pixel (Android 8 to 15): Settings › Apps › Special app access › Install unknown apps › pick the app › turn on Allow from this source.

Samsung One UI: Settings › Apps › tap the three-dot menu or Special access › Install unknown apps › choose the app.

Xiaomi, Redmi, POCO (MIUI and HyperOS): Settings › Privacy protection › Special permissions › Install unknown apps. Xiaomi also shows a separate security scan when the package opens; you can turn that off in the Security app under Settings › Install monitoring.

OPPO, realme, OnePlus (ColorOS and OxygenOS): Settings › Security or Privacy › Install unknown apps.

Huawei EMUI: Settings › Security › More settings › Install apps from external sources.

If a menu is missing, search the Settings app for "unknown" or "install apps", which works on every manufacturer skin.

Which app to allow

Allow the app you actually open the package with. If you download in Chrome and tap the file in Chrome's download list, allow Chrome. If you open it from Files or a file manager, allow that. For XAPK bundles, allow the installer app (APKPure or SAI). Permissions you do not need can stay off.

Why the dialog keeps coming back

Some manufacturers reset the permission after a system update, and Android 13 and later block the setting for apps installed from a source Google considers "restricted" until you confirm in the app's info page. Open Settings › Apps › the app › tap the three-dot menu › Allow restricted settings, then try again.

What the permission does not do

Allowing a source does not disable Play Protect, which still scans the package, and does not change the signature check. A package signed by a different developer than the installed copy will still be refused. See fixing "App not installed" if the install fails after the permission is granted.