How does APKBasket verify an APK before listing it?

Every upload passes a 47-point integrity scan: original developer signature check, manifest diff against the prior version, VirusTotal cross-report, static and dynamic sandbox analysis, and a re-signing tamper check. Median turnaround is 14 minutes from upload to public listing.

Is APKBasket free to use?

Yes. APKBasket is and has always been free — no subscription, no paid plan, no signup required to download any verified APK.

How is APKBasket different from APKMirror, APKPure, or APKMonk?

APKBasket runs a 47-point integrity scan, ships a diff'd manifest and original developer signature with every listing, and has a 14-minute median verification turnaround — roughly 6x faster than the three named competitors on the same submissions.

Does APKBasket host pirated or paid apps?

No. The index carries only free, beta, open-source, or developer-consented APKs. In 2024 the scanner blocklisted 18,400+ repackaged or malicious submissions before they reached public listings.

~/apkbasket$ verified apk download —

The Curated Basket for Verified Android APKs — Trusted by 3.2 Million Developers & Power Users Worldwide.

APKBasket is the only APK index that runs every upload through a 47-point integrity scan before it ever reaches the basket — giving Android users and developers a single trusted source for verified, version-pinned, and SHA-256 signed APK files.

47-point scan
14 min median
99.97% uptime

Est. 2018 · Tallinn, EE 1.84M APKs indexed 312,000 packages

pkg	version	sha-256 prefix	scan result	cleared
org.fdroid.fdroid	1.19.2	a3f1c8…9e2b4d	47/47 pass	3m ago	fetch →
com.signal.android	6.42.3	7b04de…f12c88	47/47 pass	7m ago	fetch →
com.termux	0.118.1	c901f2…4a7b65	47/47 pass	11m ago	fetch →
org.telegram.messenger	10.12.0	5d82ae…0c33f1	47/47 pass	14m ago	fetch →

stream: live · source: scanner.apkbasket.net View full scanner feed

// integrity_spec

What the 47-point integrity scan actually checks

No other public mirror publishes the checklist. Four direct competitors omit the manifest diff entirely; two more skip original-signature verification. Here is the full breakdown grouped into four categories — signature, manifest, static analysis, and a sandbox pass that runs every APK in an instrumented emulator for 90 seconds before it can publish.

01 Signature & Signing

SHA-256 fingerprint computed against the entire archive
Original developer certificate recovered from Google Play metadata
v1 / v2 / v3 / v3.1 signature chain validation
JAR manifest signature parity across every entry
Re-signing detection via cert-hash diff against last known-good
Key rotation events flagged when cert < 24h old

02 Manifest Diff

Line-by-line diff vs. upstream Manifest.xml
Permission delta vs. previous version — new perms are escalated
Component exposure: exported services, receivers, providers
Target SDK floor: flagged if dropped below declared API level
Native lib load paths inspected (loadLibrary / System.load)
WebView JS bridge interface allowlist check

03 Static Analysis

DEX disassembly: known malware family signatures (Slayer, Joker, Hydra)
Reflection-based dynamic code-load discovery
Encrypted payload heuristics (XOR / AES / RC4)
Tracker SDK inventory — 312 SDKs catalogued
Anti-debug and anti-emulator string detection
Resource hash pinning & assets tampering check

04 Dynamic Sandbox

90-second run in instrumented emulator
Network egress allowlisted to scanner-sink only
Filesystem write targets recorded
Broadcast / service start intent log
C2 callback domain cross-check vs. threat intel feed
Crypto key material leak telemetry

If any of the 47 fails — the APK is held, escalated to a reverse-engineering analyst, and never reaches the public basket. In 2024 we blocklisted 18,400+ APKs that way.

// by_the_numbers · audited 2024-10

The index that the rest of the ecosystem quietly relies on.

1.84M Verified APKs

Largest open index after Google Play itself.

3.2M Monthly Active Users

Verified October 2024, sampled across 187 countries.

18,400+ Blocked in 2024

Malicious or repackaged APKs caught before public listing.

14 min Median Verification

6× faster than APKMonk, APKMirror, or APKPure on the same submissions.

// third_party_validation

Institutional receipts — not testimonials.

Award

Best Niche Android Resource 2023

XDA Developers Portal · annual community awards

read →
Partner

AndroidPolice Labs Beta-Channel

Exclusive redistribution partner since March 2021

read →
Audit

99.97% Uptime · Trailing 24 Months

Audited quarterly by StatusGator · report available on request

read →

[01]

Beta Builds

42,300 packages

Pre-release and beta-channel APKs from the AndroidPolice Labs distribution pipeline and other consented developer feeds.

browse → [02]

Region-Locked

8,940 packages

Apps that are not normally distributed in your country, with verified original signatures and no repackaging.

browse → [03]

Legacy · Pre-API 21

17,500 packages

Older APKs preserved for secondary-device and embedded deployments, scanned against the same 47-point checklist.

browse → [04]

Modded · Developer-Consented

6,210 packages

Patches and bundles released by the upstream developer or a documented open-source maintainer — never unauthorized.

browse →

Index snapshot: 1,840,000+ verified APKs across 312,000 Android package names. Refreshed every 14 minutes from the scanner pipeline.

Open the scanner