How to check an app's permissions before installing an APK
Advertisement
Why the installer does not tell you
Since Android 6, apps ask for dangerous permissions at run time, so the install screen no longer lists them. The manifest still declares everything the app can ever request, and that list is what you want to read before installing something from outside the store.
Reading the list
- On the phone: open the file with SAI, App Manager or APK Analyzer instead of the stock installer. All three show the declared permissions of a file before installation, grouped by risk.
- On a computer:
aapt dump permissions file.apkfrom the Android SDK build-tools prints the list. Android Studio's Analyze APK (drag the file into the IDE) shows the decoded manifest. - The Play listing: the Data safety section and, at the bottom of About this app, App permissions list what the current Play build declares. A mirror's build of the same version declares the same set.
Permissions worth a second look
| Permission | Legitimate for | Suspicious for |
|---|---|---|
| SMS (read, send) | Messaging apps, some banking | Games, wallpapers, utilities |
| Accessibility service | Screen readers, automation tools, password managers | Anything that does not explain why |
| Device admin | Enterprise management, anti-theft | Everything else |
| Install packages | App stores, installers | Games, media apps |
| Read call log, contacts | Dialers, messengers | Most other categories |
| Draw over other apps | Chat heads, screen filters | Apps with no overlay feature |
| All files access | File managers, backup tools | Photo editors, players (they should use the media picker) |
A permission is not proof of malice, but a combination such as SMS plus Accessibility plus Install packages in a small utility is the classic profile of fraud apps, and it is what Google's enhanced fraud protection blocks in several countries.
After installing
Settings › Apps › the app › Permissions lets you deny anything you did not intend to grant, and Android 11 and later reset unused permissions automatically. For a package you are unsure about, install it, deny everything, and see whether the app's core feature still works before granting anything.
This guide describes general Android behaviour; menu names vary by manufacturer and Android version. Downloads on this site come from established third-party mirrors and are never modified by us.