What “Unknown Sources” Actually Does on Android (and When It’s Safe)

Almost every “download our app as an APK” page includes the same instruction: “enable Unknown Sources.” It’s presented as a harmless formality. It isn’t — it’s the single most important security decision in the whole process. Here’s what that setting actually does, and how to think about it.

What “Unknown Sources” really controls

By default, Android will only install apps that come from a trusted installer — normally the Google Play Store. Every other source is blocked. “Unknown Sources” is the switch that lifts that block. Once it’s on, an app can install other apps directly from files (APKs) it downloaded or was handed.

On older phones this was one global toggle buried in Security settings. On modern Android (8.0 and later) it’s smarter: it’s a per-app permission called “Install unknown apps.” You grant it to a specific app — say, Chrome, or your file manager — and only that app can install APKs. That’s an improvement, but the core risk is identical: you’re removing a safety check.

Why the block exists in the first place

Play Store apps go through automated scanning, are cryptographically signed, and are tied to a developer account Google can suspend. None of that is true for a random APK. The “Unknown Sources” block is Android saying: “I can’t vouch for this file, so I won’t install it unless you explicitly override me.” Turning it on is that override.

When enabling it is actually reasonable

There are legitimate reasons to sideload. F-Droid’s open-source apps, a beta you were invited to test, an app your own company distributes internally, or a region-restricted app you already trust. In each case you know and trust the source. The key word is trust you already had — not trust a download page is trying to manufacture with urgency and a countdown timer.

How to do it as safely as possible

1. Grant “Install unknown apps” to one app only — the specific browser or file manager you’re using.
2. Install the APK you actually came for.
3. Immediately go back and set that permission to “Not allowed.”
4. Open Play Store → Play Protect → Scan, to double-check what you installed.

Leaving the permission on indefinitely is the mistake. A malicious page you visit weeks later can quietly push an APK if a trusted installer still has the permission.

The Aavot angle

You may have landed here because a site offered an “Aavot APK” and told you to enable Unknown Sources. To be clear: there is no official Aavot app yet, so any such file isn’t ours. This is exactly the situation the setting is designed to protect you from. When our app is real, it’ll be on Google Play and the App Store — no Unknown Sources required. Until then, see our APK safety guide.