How to download apps safely: official website, then F-Droid, then Aurora Store

Every app you install can see some of your information, so where you get the app from matters. A fake or tampered copy of a good app is one of the easiest ways to be spied on. This guide gives you one simple rule to follow, and explains the two app stores it mentions.

The simple rule

Always try these in this order, and stop at the first one that has the app:

1. The app's official website. The safest place.
2. F-Droid. The second choice.
3. Aurora Store. The last choice, for apps you cannot find anywhere else.

Why an order? The fewer people between you and the app's maker, the fewer chances someone has had to change it. Each step down the list adds another middleman.

Why the official website comes first

• You get the app straight from the people who made it, with nobody in between.
• Good developers publish a fingerprint (a long code) that proves the file is genuine. You can check it with the AppVerifier app. If the fingerprint matches, the file has not been changed.
• Updates come from the same trusted place.

How to do it safely:

1. Find the real website. Type the address yourself or follow a link from a source you trust. Fake websites that copy real ones exist. If unsure, check the app's page on a trusted site or ask the developer.
2. Look for a Download or Android page. You are usually downloading a file ending in .apk.
3. Download it, but do not open it yet. Find the fingerprint the developer publishes (look for words like "signing certificate", "SHA-256" or "verify").
4. Open AppVerifier, choose the file, and compare the fingerprint. If it does not match, delete the file.
5. Install it. Android will ask you to allow installing from the app you used to download it. Allow it just once, then switch the permission off again.
6. Keep it up to date. The easiest way is Obtainium, an app that checks developers' pages for new versions. See how to install apps on GrapheneOS.

What is F-Droid?

F-Droid is a free app store that only contains open source apps. Open source means the app's instructions (its code) are public, so experts around the world can read them and spot anything dodgy.

What it is used for:

• Finding privacy-friendly apps, such as notes apps, maps, messengers, keyboards and tools.
• Getting apps with no adverts and no hidden trackers. F-Droid shows warnings on an app's page, called Anti-Features, if it does anything questionable, such as tracking you or using non-free services.
• Keeping apps updated in one place.

Why it is the second choice:

• F-Droid usually builds the app itself from the public code, and then signs it with F-Droid's own key. That means F-Droid is a middleman, and you have to trust F-Droid as well as the developer.
• Updates can arrive a few days later than on the developer's website.

How to get it safely:

1. Go to f-droid.org (type the address yourself).
2. Download the F-Droid app, check it with AppVerifier as above, and install it.
3. Open it, wait while it loads the list of apps, then search for the app you want.
4. Read the app's page, including any Anti-Features, and tap Install.

Apps you install from F-Droid should be updated from F-Droid. Do not install the same app from two different places, because the two copies are signed differently and will not update each other.

What is Aurora Store?

Aurora Store is a free, open source app that lets you download apps from Google's big app catalogue without a Google account of your own. When you open it you choose Anonymous, and it signs in for you.

What it is used for:

• Apps that are not on the developer's website and not on F-Droid. Many popular apps, such as banking apps or shopping apps, are only available this way.
• Getting everyday apps on a phone that has no Google apps, like GrapheneOS.

Why it is the last choice:

• Most apps in that catalogue are closed source, so nobody outside the company can check what they do.
• Many of them contain trackers and advertising.
• The anonymous sign-in uses shared accounts, so it can be slow or stop working for a while, and some apps will not run without Google's own services.
• You are trusting Aurora Store and the catalogue it reads from.

How to get it safely:

1. Install F-Droid first (see above), then search for Aurora Store inside it, or open the Aurora Store page on f-droid.org and download its file.
2. Install it and open it. When asked how to sign in, choose Anonymous.
3. Search for the app by name. Check the developer's name matches the real company before you tap Install.
4. Turn on automatic updates in Aurora Store's settings.

A quick example

You want a messaging app called ExampleChat.

1. Search for its official website. It has an Android download with a published fingerprint. Use that. Check it with AppVerifier.
2. If the website only links to an app store, look for ExampleChat in F-Droid.
3. If it is in neither, search Aurora Store.

Good habits for every app

• Only install what you need. Every app is another thing that could go wrong.
• Read the permissions an app asks for. A torch app does not need your contacts.
• Install in the right profile. Put apps you are less sure about in a separate profile. See how to use profiles on GrapheneOS.
• Do not install apps from links sent in messages, emails or adverts.
• Check an app's name and developer carefully. Fakes often differ by one letter.
• Remove apps you no longer use.

If something goes wrong

• AppVerifier says the fingerprint does not match: delete the file and do not install it. Download it again, from the real website only.
• F-Droid shows no apps: check your internet connection and wait a minute. The first load can be slow.
• Aurora Store will not log in: try again later, or switch the sign-in method in its settings.
• An app will not update: it may have been installed from a different place. Remove it and reinstall it from your first-choice source.