Android "Install unknown apps" explained, and how to turn it off again

Sooner or later, everyone who downloads an APK meets the same screen: "For your security, your phone isn't allowed to install unknown apps from this source." It's annoying, it looks a bit scary, and the instructions on most download pages are either out of date or skip the part where you should turn it back off. Let's fix that.

This guide explains what the setting really does, how it changed over the years, where to find it on the phones people actually use, what to do about the newer restrictions that catch people out, and how to leave your device safer than you found it. If you're installing the Macro Space APK, it's the step you'll need before anything else will work, and the install guide links back here for the details.

What the setting is for

Android is built so that apps normally arrive through a store. The store acts as a gatekeeper: it checks the package, knows who published it and handles updates. When you download an APK from a website, you're bypassing the store, so Android needs to be told that this particular app is allowed to bring in software from elsewhere. That permission is the "install unknown apps" setting. Without it, tapping an APK does nothing but show a warning.

The word "unknown" is doing real work. It doesn't mean "illegal" or "dangerous". It means Android doesn't know where the file came from or whether anyone has checked it. That's why the setting exists, and why it makes sense to be deliberate about it.

How it changed: old phones versus new phones

The older version was a single switch. On Android 7.1 and earlier, you went to Settings, Security, Unknown sources and flipped it on. That turned it on for everything. Any app on the phone could install other apps in the background, which is exactly how a lot of early Android malware spread.

From Android 8.0 onwards, the permission became per app. Instead of one global switch, you allow a specific app, usually your browser or your file manager, to install packages, and you can leave every other app blocked. That's a big improvement. If you downloaded the APK in Chrome, you only need to allow Chrome. A random game on the phone still can't slip another app in.

Many download pages still show the old instructions, which is why you'll see people hunting for an "Unknown sources" switch that doesn't exist on their phone. If your phone is newer than about 2017, that switch has been replaced by the per-app list.

How to allow it, step by step

The easiest route is to let Android lead you there. Download the APK, tap the downloaded file, and when the warning appears, tap Settings. You'll land on the right screen for the app you used. Turn on Allow from this source, press back, and the installer continues.

If you'd rather go there directly, here are the usual paths. Menu names shift between brands and versions, so treat these as a map rather than a promise.

Pixel and most stock Android	Settings, Apps, Special app access, Install unknown apps, then pick your browser or Files app.
Samsung (One UI)	Settings, Apps, the three-dot menu at the top right, Special access, Install unknown apps.
Xiaomi, Redmi, Poco	Settings, Privacy protection (or Apps), Special permissions, Install unknown apps.
OnePlus, Oppo, Realme	Settings, Apps, Special app access, Install unknown apps.
Android 7.1 and older	Settings, Security, Unknown sources.

If you can't find it, use the search bar at the top of Settings and type "unknown". It almost always gets you there faster than clicking through menus.

Which app should you allow?

Allow only the app you used to download or open the file, and only for as long as you need it. If you got the APK through Chrome, allow Chrome. If you moved it with a file manager and opened it from there, allow the file manager. Don't allow messaging apps, social apps or anything else that doesn't need to install software, because every app you permit is another route in.

While you're in that screen, take a moment to look at the whole list. Each app shows "Allowed" or "Not allowed" beside it. It's common to find one or two apps you set up months ago and forgot about. Anything marked allowed that you didn't deliberately allow should be switched off.

Turning it off afterwards

This is the step that most guides forget, and it's the one that matters most. Once the app is installed, go back to the same screen and set the app to Not allowed. You've finished the job; there's no reason to leave the door open. It takes ten seconds and removes a whole category of risk, including malicious downloads that try to install themselves silently later on.

On an old phone with the global switch, it's the same idea: go back to Security and turn Unknown sources off.

Restrictions that can surprise you

The permission itself is only half the picture. Newer Android versions have added extra layers, and each one can cause a confusing failure if you don't know it's there.

Google Play Protect. On most phones with Google services, Play Protect scans apps from outside the store. It might show a dialog saying it hasn't seen the app before, or warn about an unknown developer. You'll usually see a choice such as "Install anyway" or "Don't install". Read what it says. If it names a specific threat, believe it. If it's the generic unknown-developer wording, that's common for hobby apps with no store history.

Samsung Auto Blocker. On recent Samsung phones, a feature called Auto Blocker can stop installs from sources other than the official stores. If you've allowed the setting and the installer still refuses, check Settings for Auto Blocker under security and privacy, and decide whether you want to turn it off for this install. It's a sensible protection for most people, so you may prefer to switch it back on afterwards.

Restricted settings on Android 13 and newer. Apps installed from outside a store can have certain very powerful permissions, especially accessibility, held back. If an app asks you to enable accessibility and the switch is greyed out, open the app's info page, tap the three-dot menu and look for Allow restricted settings. Android does this on purpose, because accessibility access is the favourite tool of banking malware. If you're being asked for it by a game utility, think twice about granting it at all. Our article on macro apps and permissions explains why.

Old apps on new Android. Android 14 refuses to install apps that target very old versions of Android, a measure aimed at malware that relies on old loopholes. If you ever try to install a really old APK and get a vague failure, that could be the reason, and you'll find more of these in the install error fixes.

Work profiles and multiple users. On phones with a work profile, a second user or a "secure folder", the permission may need to be set inside that space, and an admin might block it altogether. If the option is missing or locked, that's the likely reason.

A note on where this is heading

Google has announced plans to require developer verification for apps installed on certified Android devices, with the rollout phased by country, and with some path for advanced users who want to install unverified apps anyway. Details and timing have been changing, so we won't try to summarise them here; check Android's current documentation if you want specifics. The practical takeaway is that installing APKs may get a bit more involved over time. It's another reason to understand the permission rather than just tap through it.

What if the option is missing or greyed out?

• You're on a work or school phone. An administrator can lock this setting. There's nothing you can do from your side.
• Parental controls are on. Family Link and similar tools can block installs from outside the store.
• Your file manager doesn't appear. Some manager apps only show up in the list after you've opened an APK from them once.
• You're using an in-app browser. Open the file from the main Downloads folder instead of from inside another app.

What happens when you tap Install

It's worth knowing what Android does with the file once you allow it, because it explains several of the error messages people run into. First the system's package installer opens the APK and reads its manifest, the list of what the app is called, what version it is and what it wants. Then it checks the signature. Every APK carries a digital signature from whoever built it, and Android refuses to install a file whose signature is broken or missing.

Next comes the update check. If an app with the same package name is already on the phone, Android compares the signatures. If they match, the new file is treated as an update and your data is kept. If they don't match, the install is blocked, because otherwise anyone could replace your real banking app with a lookalike. That's the reason you sometimes have to uninstall the old version before a new one will go in. Finally, Play Protect may scan the package before the install completes. Only then does Android copy the files into place and show you the Open button.

None of this involves the internet unless Play Protect is doing its scan, so installing an APK works fine in airplane mode, which is a handy way to prove to yourself that the install step itself isn't phoning home.

A worked example, start to finish

Let's walk through a typical case so the steps don't feel abstract. Say you've got a recent Samsung phone and you've downloaded an APK in Chrome. You open your notification shade, tap the finished download, and Android pops up a message saying Chrome isn't allowed to install unknown apps. You tap Settings. A screen appears showing a switch labelled "Allow from this source". You switch it on, press back once, and a new dialog asks if you want to install the app. You tap Install, read the result, and tap Done rather than Open, because you want to tidy up first.

Now you go to Settings, then Apps, tap the three dots, choose Special access, and open Install unknown apps. Chrome is listed as Allowed. You tap it and switch the permission off. While you're there, you scan the list. If another app, a messaging program for example, also says Allowed and you can't remember why, you switch that off too. Then you open the file manager, find the downloaded APK, and delete it. Total time: about two minutes. Result: the app is installed, and your phone is back to its locked-down state.

Mistakes people make

• Leaving it on forever. Convenience is the enemy here. A permission you granted for one install is still active a year later unless you remove it.
• Allowing the wrong app. If you allow a messaging app because you opened the APK from a chat, it now has the right to install anything it receives.
• Keeping old APK files. Left in Downloads, they can be tapped by mistake, or by someone using your phone.
• Disabling Play Protect to "fix" an error. If an install fails and a page tells you to turn off Play Protect, you're removing a safety net to solve a problem that usually has a simpler cause. Our troubleshooting guide covers the better fixes.
• Ignoring the permission prompts that follow. The install is only step one. What the app asks for the first time you open it is just as important.

Common questions

Does turning the setting off uninstall the app? No. The app stays exactly where it is and keeps working. You're only removing the right to install new things from that source.

Will it stop Google Play updates? No. Play Store updates use their own permission, so switching off unknown sources for your browser doesn't affect them.

Can I update a sideloaded app later? Yes, by installing a newer APK over it, provided it's signed with the same key. You'll need to allow the setting again for that moment and switch it off afterwards.

Is it safe to leave it on if I only use Chrome? It's safer than a global switch, but a malicious download in Chrome could then install itself with one tap. Off is better.

Why does the warning appear every time? Because the permission is per app and per source. Allowing Chrome doesn't allow your file manager, and vice versa.

A safe routine to copy

1. Get the file from the source you trust and check its fingerprint.
2. Open it, tap Settings when Android asks, and allow only that one app.
3. Go back, read any Play Protect message, and install.
4. Read the permission prompts when you first open the app.
5. Return to the setting and switch the permission off again.
6. Delete the downloaded APK file once the app works, so you don't re-open it by accident later.

If you want to see the same routine applied to a specific app, our Macro Panel overview shows what we found inside the file, and the safety checklist explains how to judge any APK before you open it. And when the installer is the thing that's stuck, that troubleshooting article is the next place to look.