How to install an APK from a QR code, safely

A developer sent you a QR code and said "install this build." That is a normal, legitimate way to distribute test apps — and it involves two Android warnings that look scarier than they are. This guide walks the whole flow: scan, download, the "install unknown apps" permission, Play Protect, and how to confirm you got the build you were promised.

What a QR install actually is

A QR code is only a link wearing a square costume. When a developer shares a build through a service like PreviewAPK, each build's page can show a QR code (the developer chooses whether it's on — it's off by default). Scanning it opens the build's page in your browser, where a download button fetches the APK — the Android installer file — to your phone. From there, Android's own installer takes over. Nothing about the QR changes what an APK is; it just saves you typing a URL.

The rest of this guide assumes the most common case: someone you know — a developer, your QA team, a freelancer — sent you the code for a build you're expecting.

Step by step: scan, download, install

1. Scan the code with your camera app (most Android phones recognize QR codes natively) or Google Lens. Tap the link preview that appears — check it points at the address the sender told you to expect.
2. Download the APK from the page that opens. Your browser will warn that "this type of file can harm your device." That message appears for every APK, always. If you're expecting this build, tap OK/Download anyway.
3. Open the downloaded file from the notification or your Downloads folder, and tap Install.
4. Allow "install unknown apps" for your browser. The first time, Android stops and sends you to a settings toggle: "Allow from this source." Turn it on, go back, and the install continues. Since Android 8 this permission is per-app — you're allowing your browser to install this file, not opening your phone to everything.
5. Handle the Play Protect prompt if it appears (next section), then tap Install. The app lands on your phone like any other — open it and start testing.

That's the whole flow — the same one install APK online builds are shared through. Two minutes, most of it Android's checkpoints.

Play Protect warnings, translated

Google Play Protect scans apps that arrive from outside the Play Store, and test builds are its favorite false alarm. Typical messages and what they actually mean:

• "Harmful app blocked" / "unsafe app blocked" — Play Protect doesn't recognize the app or its developer because the build was never published. For a build a known sender just gave you, this is the expected case; there's usually a "More details" → "Install anyway" path. For anything you weren't expecting, treat it as a genuine stop sign.
• "This app was built for an older version of Android" — a compatibility note, not a security one. The build's target version is simply older than your phone's. Fine for a test build; note it and move on.
• Permission review — after installing, check what the app asks for. A flashlight app requesting your contacts is a red flag no matter who sent it. A business app requesting the camera for its scanner feature is not.

The rule that covers every case: warnings mean "Google can't vouch for this." Your job is to supply the vouching yourself — do you know who sent it, and were you expecting it?

Verify it's the build you expected

• App name and icon on the install screen should match what the sender described — before you tap Install, not after.
• Version: after installing, open Settings → Apps → the app, and compare the version name/number with the one the sender gave you. Mismatches usually mean an older download is still in your Downloads folder — delete stale APKs between rounds.
• Source: you should have arrived from the sender's link or code, on the domain they named. If a "download" page is plastered with unrelated ads and fake buttons, you're in the wrong place.

When NOT to install a QR APK

Skip it, without a second thought, when: the code is on a sticker, poster, or parking ticket (a known scam pattern — real payments never arrive by QR-to-APK); the message was unsolicited ("your bank app needs updating — scan here"); you can't name who sent it; or the install page asks for anything beyond the APK itself, like a profile, certificate, or payment. Developers sharing test builds can always offer you the browser preview instead — a legitimate sender won't pressure you past a warning.

One last hygiene step: once your build is installed, go back to Settings and switch "allow from this source" off for your browser. You can re-enable it in seconds for the next round.

FAQ

Is it safe to install an APK from a QR code?

It depends entirely on whose code it is. A QR code is just a link. If a developer or team you know sent it for a build you're expecting, installing it with Android's standard prompts is a normal part of testing. A QR code from a stranger, a random sticker, or an unsolicited message deserves the same suspicion as any unknown download — don't install it.

Why does Android ask me to allow "install unknown apps"?

Apps installed outside Google Play are "unknown" by definition. Since Android 8, the permission is granted per app — you allow the browser (or file manager) that downloaded the APK to install it. It's a checkpoint, not an error: grant it for the install you're doing, and you can switch it back off afterwards.

Play Protect warned me about the app. What does that mean?

Play Protect scans apps installed from outside the Play Store. Test builds routinely trigger warnings because they aren't published apps from known developers — the warning means "Google doesn't recognize this," not "this is malware." If you know the sender and expected the build, that's the normal case. If you didn't expect it, take the warning at face value and stop.

Can I install an APK from a QR code on an iPhone?

No. APKs are Android packages; iOS cannot install them in any form. On an iPhone you can still open the sender's preview link and run the app in your browser — ask the developer for the preview link instead of the QR code.

Keep going

• Install APK online — how the per-device QR and download settings work.
• Send test builds to testers — the sender's side of this flow.
• Share an APK with clients — when a browser preview beats installing at all.