F-Droid answers the safety question differently than every other name in this cluster. Google’s February 2026 security report found Play Protect identified more than 27 million new malicious apps from outside Google Play in 2025 and blocked 266 million risky install attempts, and Android Police has reported that apps downloaded outside the Play Store are 50 times more likely to carry malware than apps installed through it. Most of that risk comes from the source, not from sideloading as a category.
Where APKMirror, APKPure, and Uptodown all take a compiled file from a developer and check it before publishing, F-Droid builds almost every listing itself, directly from source code it can read. That is a structurally different guarantee, and this review checks it against what is actually documented: F-Droid’s own inclusion policy, its published security model, its build pipeline, and the real criticism the privacy community has raised about it. None of it is based on hands-on testing of individual files. It is a comparison against F-Droid’s own docs at f-droid.org, verified 2026-08-12.
The honest challenges here are different from the rest of this cluster too. A build-from-source model does not mean instant updates, a large catalogue, or zero criticism from security researchers, and pretending otherwise would undersell what actually makes F-Droid worth using. For the wider picture across every major source, our full audit of the major APK sites covers APKMirror, APKPure, Aptoide, and Uptodown alongside F-Droid.
Is F-Droid Safe? The Short Answer
Yes, and it earns that answer through its model rather than through scanning. F-Droid’s own Inclusion Policy states that all applications in the repository must be Free, Libre and Open Source Software, verified “both by visual inspection of the source and by building the application from the published source.” F-Droid’s own developer FAQ states plainly that “in all but a very few cases, we build all applications directly from the source code”, which removes user uploads from the picture entirely.
What that buys you is not a scan verdict but a chain of custody. A file cannot be silently repackaged and republished, because F-Droid is not accepting a stranger’s binary in the first place. It also means the model has real costs: a catalogue restricted to open-source software, and updates that move on F-Droid’s build schedule rather than the developer’s. Both are covered below.
The Real Challenges With Any Third-Party APK Download
- Open source is not automatically secure. Readable code lowers the bar for review; it does not guarantee anyone actually reviewed it line by line before F-Droid built it.
- A build-from-source pipeline is slower by design. Every update has to pass through review and an offline build step, which trades speed for verifiability.
- Policy restrictions can force older components. F-Droid’s ban on proprietary dependencies has, in at least one documented case, kept an app on an outdated library long after the developer’s own build moved on.
- A small, curated catalogue is a real limitation. If the app you need is not free and open-source software, F-Droid is not going to have it, full stop.
F-Droid at a Glance
| Signal | What we verified |
|---|---|
| Founded | 2010, by Ciaran Gultnieks, per F-Droid’s own about page |
| Legal entity | Legally represented by The Commons Conservancy, a Netherlands-based nonprofit foundation |
| Inclusion policy | Free and open-source software only; verified by source inspection and building from source |
| Who can upload | No one uploads a binary; F-Droid builds nearly every app itself from published source |
| Signing model | F-Droid signs most builds itself on an offline machine; reproducible builds can carry the developer’s own signature instead |
| Transparency system | Anti-Features labels: 10 categories including tracking, ads, and non-free dependencies |
| Catalogue size | Approximately 4,178 apps in the main repository, per a third-party repository tracker checked 2026-08-12 |
| Documented incidents | None found in this review distributing a compromised file, checked 2026-08-12 |
Who Runs F-Droid, and Why That Matters
F-Droid’s own about page states the project was founded in 2010 by Ciaran Gultnieks and is made by volunteers who care about free and open software, and that it is “legally represented by our Commons Conservancy Programme.” The Commons Conservancy itself describes F-Droid as a platform and catalogue of free and open-source applications for Android that is itself free and open-source software, run as a Programme inside a Netherlands-based nonprofit foundation. There is no company chasing growth targets or advertising revenue behind either name.
That structure changes the incentives in a way worth naming plainly. A volunteer nonprofit answering to a community charter has no shareholder pressure to inflate catalogue size or wave through a borderline submission to keep numbers up. Compare that with APKPure, which discloses no ownership on its own site and has to be inferred from stale corporate filings. F-Droid names its legal home directly, on its own page, in plain text.
How an App Gets Into F-Droid’s Catalogue
The process is public and auditable, not a black box. F-Droid’s developer FAQ describes the standard path as a merge request against the fdroiddata repository, following build metadata instructions, or an entry in F-Droid’s public “Requests for Packaging” tracker for apps not yet submitted by their own developer.
The step that actually matters happens after submission. F-Droid’s published Security Model states that every package is built in a completely fresh, isolated virtual machine environment, and that signing for the official repository happens on a dedicated machine kept offline from the internet. The app you download did not arrive as someone’s compiled upload; it was assembled by F-Droid’s own build farm from the source code sitting in that merge request, which is also archived alongside build logs for anyone to check later.
Before any of that, the submission has to clear F-Droid’s Inclusion Policy: a FOSS license F-Droid recognizes, no bundled proprietary tracking or advertising libraries such as Google Play Services, Firebase, or Crashlytics, and no downloading additional executable code without explicit consent. Apps that meet the license bar but still carry a real trade-off, a non-free dependency, ads, or tracking, are not rejected outright; they are labeled instead, which is the subject of the next section.
What F-Droid’s Model Uniquely Guarantees, and What It Costs
The guarantee is specific: nothing in the main repository arrived as an anonymous binary. F-Droid’s Anti-Features documentation lists ten labeled categories, including Tracking, Ads, Non-Free Dependencies, Non-Free Assets, and Known Vulnerability, and states that apps carrying one of these traits “can then be marked with these Anti-Features so users can clearly choose whether the app is still acceptable.” The client hides apps flagged for tracking by default. That is a level of disclosure none of the scan-based sources in this cluster attempt, because scanning tells you whether a file is malicious, not whether a clean, legitimately signed app is quietly reporting your activity somewhere.
The signing model has one nuance worth being precise about. F-Droid’s documentation confirms it signs each app with its own key by default, generated and controlled on that offline machine. Where a developer’s build is fully reproducible, meaning independent parties compiling the same source produce a byte-for-byte identical binary, F-Droid can instead distribute the app carrying the developer’s own signature, with F-Droid’s rebuild serving as public proof the two match. F-Droid’s own reproducibility status is shown per app rather than as one repository-wide percentage, so this review could not confirm what share of the current catalogue qualifies; check the Reproducibility Status on the individual app page at f-droid.org before relying on it for a specific app.
None of this is free. The catalogue is deliberately small: a third-party tracker of F-Droid’s live main repository counted 4,178 apps as of 2026-08-12, a fraction of what a store like Google Play or even Uptodown carries, because the FOSS-only bar excludes most mainstream commercial software by design. And build-from-source review takes time that a straight upload does not. Independent security researchers at privsec.dev documented a concrete case in December 2022: F-Droid’s policy against bundling Google-hosted proprietary binaries forced the Snikket messaging app onto an older WebRTC library, “from Google’s Maven repository, which stopped releasing new builds in January 2020,” while Snikket’s own Play Store build stayed current. The same piece argued F-Droid’s official client lacked TLS certificate pinning and that the offline signing infrastructure structurally slows how fast updates reach users. GrapheneOS’s own official account has separately posted publicly that it considers F-Droid’s security practices poor, a claim distinct from the privsec.dev piece itself. This review could not verify what, if anything, F-Droid has changed in response since 2022; mark that specific point NEEDS-VERIFICATION and check F-Droid’s current documentation directly if it is a deciding factor for you.
What F-Droid Does Not Protect You From
Open-source visibility is not the same as review. Anyone being able to read the code is not the same as someone having actually read it before F-Droid built it. Vulnerabilities can and do sit in FOSS code for years before anyone notices, the same as in any other software.
A slower pipeline means a slower patch for anything urgent. The build-and-sign process that makes tampering hard also means F-Droid is not the fastest place to get a critical security fix the moment a developer ships it.
The Anti-Features system depends on developers disclosing what their app does. F-Droid flags what it can detect and what gets reported; it is not an independent runtime audit of every app’s network traffic.
A legitimate FOSS license does not mean a well-built app. Nothing about F-Droid’s model evaluates code quality or whether a small, under-maintained project handles your data carefully. Read the permission list and the Anti-Features tags before you install, the same discipline that applies everywhere else.
How to Check Any F-Droid File Yourself
- Read the Anti-Features tags on the listing, not just the description. An app with Tracking or Non-Free Dependencies flagged is not automatically disqualifying, but it changes what you should expect from it.
- Check the Reproducibility Status on the app’s own F-Droid page. A reproducible build with the developer’s own signature is the strongest verification F-Droid offers for that specific app.
- Compare the version number against the developer’s own release channel if one exists, so you know whether you are trading currency for verification on that particular app.
- Verify the signing certificate yourself with
apksigner verify --print-certsagainst the downloaded file, especially before trusting an update over a version you already installed. - Leave Google Play Protect on. It evaluates sideloaded apps too, F-Droid’s included, and keeps checking after installation as new signatures appear.
Our step-by-step walkthrough for checking any APK for malware covers the certificate and permission checks in more depth, and our safe-install checklist covers the Android settings around them. If open-source software is specifically what you are after, our roundup of open-source offline dictionary apps for Android is a practical look at what F-Droid’s catalogue actually looks like in one category.
F-Droid Compared to the Other Major Sources
F-Droid is the only source in this cluster that does not accept a user-uploaded binary at all, and that is a genuinely different guarantee than a review or a scan applied after the fact. APKMirror manually reviews files a developer submits and matches new uploads against prior signatures, which is a strong check for mainstream apps F-Droid will never carry. Uptodown runs every submission through VirusTotal’s 70-plus engines and publishes its own scanning statistics, the most transparent scan-based operator in this market. Both are reviewing something a developer handed them. F-Droid built the file itself, from source it can also show you.
The trade-off runs the other way on scope and speed. Uptodown and APKMirror mirror mainstream proprietary apps the day they ship; F-Droid cannot carry those apps at all and can lag its own listed open-source apps behind their latest release, as the Snikket case above shows. APKPure remains the weakest operator on this measure across the board: no disclosed ownership, no published verification methodology, and a documented 2021 incident in which its own official app shipped a Triada trojan dropper. Judge F-Droid on what it actually promises, an auditable build from open source, not on catalogue size.
When F-Droid Is the Right Call, and When It Isn’t
F-Droid is the strongest choice when the app you want is free and open-source software and you want the closest thing to a verifiable chain from source code to the file on your phone. It is also the right call if tracking and non-free dependencies matter to you specifically, since the Anti-Features system surfaces exactly that before you install, not after.
It is the wrong call when you need a mainstream proprietary app, a specific brand-name game, or the very latest security patch the moment a developer ships it. F-Droid was never built to compete on catalogue size or update speed, and treating a small, slower-moving repository as a shortcoming misreads what it is actually optimized for. For that gap, Uptodown’s published scanning statistics or APKMirror’s signature-matched mainstream catalogue are the more defensible choice.
Whichever source fits your download, the file-level checks above still apply. F-Droid’s model removes an entire category of risk before you even open the app; it does not remove the five minutes of checking that belongs to every sideloaded install.
This review is part of our app safety and privacy coverage, which audits download sources and app privacy claims against what each operator actually publishes.
