Request an app

A request is a name. Someone asks for an app, and we are left holding a string of characters and the job of finding a file that matches it. That is exactly the wrong way round, because the file is the hard part. Somebody has to decide which build is genuine, and that decision cannot be made from a request — it has to come from whoever compiled the code, or from a source that can be checked against them.

Sites that fill requests by going and finding an APK somewhere are doing the one thing this catalogue exists to avoid. They end up hosting whatever turned up under the right name, and their users end up trusting a file whose entire provenance is that somebody asked for it and somebody else produced it. The package name is an app's identity on Android, and anyone can put any package name on any file. If we cannot say where a build came from, we should not be listing it, however many people would like us to.

So the queue runs the other way. Publishers bring builds, we check what can be checked mechanically, and a person reads the rest. It is slower and it means the catalogue has gaps. The gaps are the point.

This is the case the site is built around, and it is worth knowing what to expect before you start. Submissions need an account, so sign in first. You will be asked what the app is, which package name it claims, and where the build came from — and to confirm you have the right to distribute it. Nothing goes live on submission.

Two things then happen automatically. We compute the SHA-256 of the file, which becomes the fingerprint published on the listing so anyone can confirm the build they downloaded is the one we hold. And we read the signing certificate and compare it with earlier releases of the same package. A certificate that does not match blocks approval — that check is the whole basis of the "signature verified" line on a listing, and it is not something a submitter can talk their way past.

After that, a moderator reads the entry. The review is about whether the submission is what it says it is, not about whether the app is any good. The content policy sets out what is not accepted; the short version is that pirated, cracked and modified builds of other people's software are never listed, regardless of who submits them.

Worth stating plainly, because it shapes what a request would even be worth: APKBrowse does not scan for malware. We record hashes and signing certificates, and we link the official store first whenever one exists. Those establish provenance — where a build came from, and whether it changed on the way to you. They are not a judgement about what the code does once it is running on your phone.

That is also why "can you add this app" is a harder question than it looks. Adding a listing would put our name next to a file, and the only thing we could honestly say about a build we went and found ourselves is that we found it. That is not worth a listing.