To share an APK without Google Play, upload the signed APK to a host that serves it over https (your website, cloud storage with a direct link, or a release page), share that link or a QR code to it, and tell users to allow "Install unknown apps" for the app they open it with. Keep the same package name and signing key for updates so new versions install over old ones.
Key takeaways
- Any https link to the .apk file works; a QR code makes it one scan.
- Users must allow installs from the browser or file app they use — once.
- Updates require the same package name, the same signing key and a higher version code.
- Messaging apps sometimes rename or block .apk files — a link is more reliable.
Distribution options compared
| Method | Good for | Watch out for |
|---|---|---|
| Link on your website | Public apps, portfolios | Serve with content type application/vnd.android.package-archive |
| Cloud storage (Drive, Dropbox) | Small groups | Preview pages; use the direct-download link |
| QR code | Events, shops, classrooms | Encode the https link, not the file |
| Email attachment | One client | Gmail and others may block APK attachments |
| Messaging apps | Friends and testers | Some rename or flag .apk files |
| Alternative stores | Wider reach | Each has its own review and listing rules |
Host the file properly
A web server should send the APK with Content-Type: application/vnd.android.package-archive so Android recognises it. Most hosts do this automatically for the .apk extension. Use a stable URL (for example /app/latest.apk) so printed QR codes keep working after updates.
Make a QR code
Encode the https download URL. Print it at least 2 cm wide with a quiet margin, and put the app name and "Android only" next to it. Test the scan with two different phones before printing.
What the user sees
- They open the link; the browser warns that this type of file can be harmful — they tap Download anyway.
- They tap the downloaded file. The first time, Android asks to allow the browser to install unknown apps; they open Settings, toggle it on, and go back.
- Google Play Protect may scan the app or show a warning for apps it has not seen before — see Play Protect warnings.
- They tap Install, then Open.
Write these steps next to your link — clear instructions halve the support messages. If someone sees "App not installed", the install error decoder finds the reason.
Updates
A new version installs over the old one, keeping its data, only when the package name and signing certificate match and the version code is higher. If you change any of these, users must uninstall first and lose their local data. There is no automatic update outside a store; show an "update available" notice in your HTML by fetching a small JSON file from your server when online.
Be a good citizen
Only ask people to install apps from sources they trust — yours. Do not request permissions the app does not use, and say what the app does on the download page. Sideloading is a normal part of Android, but users are right to be careful.
Frequently asked questions
Is it legal to distribute an APK outside Google Play?
Yes. Android allows installing apps from other sources, and you may distribute your own apps however you like, subject to the law and any licences in your content.
Will my sideloaded app update automatically?
No. Users install updates by downloading the new APK. You can show an in-app notice when a new version is available.