What F-Droid is, and what sideloading means
Most Android apps come from Google Play. Android can also install an app from a file called an APK, short for Android package, which is the same idea as an installer on a Windows PC. Installing an app that way, from anywhere other than the phone’s built-in store, is called sideloading.
F-Droid is an app store that you sideload once, and that then installs and updates other apps for you. It only lists free and open-source apps, meaning anyone can read the code they’re made from, and it builds most of them itself from that code rather than taking the developer’s word for what’s inside. Each listing flags anti-features, such as tracking, adverts or reliance on a paid service, so you know before you install.
Many of the apps that pair best with a home server are here. Some are only here, and some come in a version without Google’s services built in.
Play Store, F-Droid, or both: one rule
Use both. Google Play stays the place for banking apps, paid apps and anything closed-source, and F-Droid covers the open-source tools. The one rule is one app, one source.
Every app carries a digital signature that proves an update comes from the same place as the original. F-Droid signs the apps it builds with its own key, so an app installed from the Play Store can’t be updated from F-Droid, or the other way round. Switching means uninstalling first, which can delete the app’s data, so choose a source for each app and keep it there.
| Where from | What it has | Account needed |
|---|---|---|
| Google Play | Almost everything, including paid apps | A Google account |
| F-Droid | Open-source apps only, with anti-features labelled | None |
| The developer’s own page | The newest release, often a few days before F-Droid | None |
What happens when you install from outside the Play Store
Android protects you in layers, and you’ll meet each one once.
- Install unknown apps. Android won’t let an app install other apps until you allow it, one app at a time. The first time you open an APK from your browser, Android says so and offers a Settings button. Switch on Allow from this source for the browser and go back. You can review the list later under Settings, Apps, Special app access, Install unknown apps. Menu names vary a little between makers.
- Play Protect. Google’s built-in malware scanner checks apps from every source, and it may ask to scan an app it hasn’t seen before. Let it. If it says an app is harmful, don’t install it.
- Samsung’s Auto Blocker. Galaxy phones that came with One UI 6.1.1 or later have it switched on, and it blocks installs from outside the Play Store and Galaxy Store. Turn it off under Settings, Security and privacy, Auto Blocker. While it’s on, apps you sideloaded can’t update.
Google is adding one more layer, called developer verification. Apps on certified Android phones and tablets will have to come from developers who have registered with Google, wherever you install them from. It began on 30 September 2026 with apps from certain stores in Brazil, Indonesia, Singapore and Thailand, and Google says it will reach the rest of the world in 2027. For apps from developers who haven’t registered there’s a one-time “advanced flow”: turn on Developer options, confirm nobody is talking you through it, restart, wait one day, confirm it’s you with your fingerprint, face or PIN, then allow such installs for seven days or for good. F-Droid has publicly opposed the change. For now, installing from F-Droid or a developer’s own page works as it always has.
What it needs
- An Android phone or tablet on Android 7 or later. F-Droid 2.0 dropped Android 6, and older F-Droid releases still work on older phones.
- A few minutes, and no account of any kind.
- For the server apps further down, a home server, and Tailscale if you want them to work away from home. See remote access.
How F-Droid fits in
F-Droid 2.0, a full redesign, began rolling out in late September 2026. Day to day it gives you:
- Three sections. Discover for new, updated and popular apps, Search, and My Apps for what you’ve installed.
- Anti-feature labels on every listing, with filters to hide apps that have the ones you don’t want.
- Automatic update checks, on by default, with every pending update in one list.
- Installs you approve up front. On phones that support it, you confirm before the download rather than after.
- Extra repositories. A repository is a list of apps F-Droid can install from. Some developers run their own, and Bitwarden offers one for its password manager.
The easy way to set it up
No computer and no terminal. Everything happens on the phone:
- Open f-droid.org in your browser and tap Download F-Droid. The file is called F-Droid.apk.
- Open the download. Android says your browser isn’t allowed to install apps. Tap Settings, switch on Allow from this source, and go back.
- Tap Install. If Play Protect offers to scan it, let it.
- If a Samsung phone refuses, turn off Auto Blocker as described above. If you turn it back on later, F-Droid can’t update your apps.
- Open F-Droid and give it a moment to load its list of apps the first time.
- Search for an app and tap Install. Android asks once more, this time to let F-Droid install apps. Allow it.
- Go back to Settings, Apps, Special app access, Install unknown apps, and switch your browser off again. F-Droid keeps its permission, so updates still work.
People comfortable with a computer can install any APK over a USB cable with Android’s adb tool, but nothing here needs it.
Apps that pair with a home server
Each of these asks for your server’s address the first time you open it.
| On the server | On Android | Where to get it |
|---|---|---|
| Tailscale | Tailscale | Play Store or F-Droid |
| Immich | Immich | Play Store or F-Droid. See photo backups. |
| Jellyfin | Jellyfin | Play Store or F-Droid. See media servers. |
| Home Assistant | Home Assistant | Play Store, or a minimal version without Google’s services on F-Droid |
| Vaultwarden | Bitwarden | Play Store, or Bitwarden’s own F-Droid repository, whose version doesn’t sync changes instantly |
| Nextcloud | Nextcloud | Play Store or F-Droid |
| Nextcloud calendars and contacts | DAVx5 | Paid on the Play Store, free on F-Droid |
| Syncthing | Syncthing-Fork | F-Droid or its GitHub page |
| Audiobookshelf | Audiobookshelf | Play Store |
Questions people ask
Is sideloading safe?
It’s as safe as the place the file comes from. F-Droid, a developer’s own site or GitHub page, and the Play Store are fine. Sites that rehost other people’s apps, especially ones offering paid apps for free, are a common way to pick up malware.
Will Google’s new rules stop F-Droid working?
Not for now. When the checks reach the rest of the world in 2027, apps from unregistered developers will need the one-time advanced flow described above, after which they install with a warning. F-Droid’s homepage carries a notice about the change, so check its news before then.
Why is the F-Droid version behind the Play Store?
F-Droid builds each release itself from the published code, which usually takes a few days. Obtainium, in the options below, fetches releases straight from the developer if you want them on day one.
Can I move an app from the Play Store to F-Droid?
Yes, but uninstall the Play Store copy first, and export or back up its data before you do, because uninstalling removes it.
Do I need to root my phone?
No. Rooting, which gives apps full control of the system, isn’t needed for anything on this page, and it stops many banking apps from working.
