What is Sideloading?

Sideloading means installing an app on a device without using an official application store. Sideloading is natively supported on some platforms like Android but requires system modifications on others. Of course, sideloading raises privacy concerns, so is it really safe? Why would you even need to sideload? Let’s talk about it. 

Most modern devices — phones, tablets, and even laptops — come with some kind of app store where you can download and install verified and safe applications. Android has the Google Play Store, Apple’s iOS uses the App Store, Windows has the Microsoft Store, and so on. 

Windows and Android support sideloading natively for users, while iOS does not.

App Management with Esper

Is sideloading safe?

You’ll often hear that sideloading isn’t safe, which is both true and false  — it’s all about the trustworthiness of the apps you plan to sideload. We’re going to focus on Android for our examples, but the same rules could apply to other operating systems, too. 

Sideloading is only as safe as the source you use to acquire those application files. If you can't verify that your source is not tampering with those application files, you can't be sure those applications are safe. For example, sideloading from app stores like F-Droid or the Amazon Appstore is relatively safe. Even downloading apps directly from the web can be safe if you use a reliable source. 

Some platforms will also require you to enable sideloading. On Android, sideloading requires the “Install unknown apps” permission to be enabled for any app that you will use to install other apps. For example, when you use Chrome to download an APK (Android Package Kit — the installable format for apps on Android), it requires the “Install unknown apps” permission to be enabled before it can install the APK. Third-party app stores require this feature to be enabled before they can install apps, as well. 

The good news is that we have some excellent recommendations for where to grab apps safely. 

Where to get safe Android apps to sideload

While there are plenty of places that host APKs (Android Package Kits — the container for installable apps on Android), the majority should be avoided. Here are sources we trust and recommend: 

• APK Mirror: APK Mirror is the best APK hosting site on the web, as it’s highly trustworthy — every APK is vetted by a real life human being before it’s approved and uploaded to the site. The downside is that there can be a steep learning curve to using APK Mirror because you oftentimes need to know exactly what type of architecture and DPI your device is running. There can be dozens of the same APK for a single app and you need to know all the details to make sure you get the right one. How-to Geek has an explainer that can help discern the differences. 
• F-Droid: If free and open source is your flavor, then F-Droid is the app store for you (it’s really more of a repository since everything is free, but now we’re just splitting hairs). It’s a highly-trusted resource in the open source community. And since every app is open source, you’re free to download and inspect the source code for your own protection. 
• Amazon Appstore: Amazon’s Appstore is probably the most well-known of all the third-party app stores on Android. Similar to Google Play, Amazon has a vetting process that checks apps for potential malware before making them accessible for download. It has a large repository of available apps and can automatically update apps when new versions are available. It’s the best option for AOSP devices since they don’t have access to Google Play. 

The nice thing here is that you don't have to choose one single source for apps — you can pick and choose as necessary. If one store doesn’t have what you need, there are other options available. 

How to sideload apps on Android

Setting up Android to accept sideloading apps is easy peasy — it’s one simple toggle per app that you want to allow installation from. You can go about this one of two ways: proactively or grant the permission at the time of installation. 

To set up proactive approval for app installation, open the device’s settings menu. From there, select “Apps.” 

In the Apps menu, find the app that you’ll be installing from. So, for example, if you’re downloading an APK from Chrome, you’ll need to grant Chrome the permission to install unknown apps. 

With the app settings open, scroll down to the bottom of the list and look for the “Install unknown apps” option. Tap into that menu and flip the toggle to enable the feature. 

Boom — that’s it. From now on, you’ll be able to install apps from that particular source. 

Note: If you’re allowing Chrome the ability to install unknown apps so you can install a third-party app store, it’s a good idea to disable this feature once the app store is installed. Leaving it enabled (especially in a browser, like Chrome) leaves the door open for security breaches. 

Otherwise, you can wait until you’re actively trying to install an app before granting the permission. So, let’s say you’re trying to install an app from F-Droid. You’ll open F-Droid, find the app you want to install, then tap the Install button. 

Once the app has downloaded, the system will notify you that F-Droid is lacking the required permission to install the app. Just tap the Settings button, flip the toggle, and you’ll be good to go. You won’t even have to launch the installer again — it’ll happen automatically. 

Need to bulk sideload apps onto fleet devices? Give us a call

Doing this manually is fine if you only need to sideload a couple of apps on a handful of devices. But if you’re looking to push apps across hundreds (or thousands) of devices, we have a better, simpler way. Sign up today and try us out — no cost or commitment.

Everything You Need to Know about MDM