the guide
Android App Permissions Explained: Which Ones Are Safe and Which Are Dangerous?
~6 min read • Updated Security Guidelines
Every Android app asks for something before it lets you use it. Sometimes it's obvious why — a camera app wants your camera, fine. But sometimes the ask is strange: a flashlight app wants your contacts, a calculator wants your location, a wallpaper app wants to read your SMS messages. Most people tap "Allow" without reading any of it, because the prompt is in the way of whatever they actually wanted to do. That habit is exactly what malicious apps count on.
The scanner above works off a simple rule: every permission should be traceable to a specific feature. If you can't explain what feature needs it, the app probably doesn't need it either. This guide walks through what the major permissions actually give an app access to, when they're reasonable, and when they're a warning sign.
What each permission actually hands over
Accessibility Services (BIND_ACCESSIBILITY_SERVICE)
This is arguably the most powerful permission in Android. Designed for users with disabilities, it allows an app to observe your screen in real time, inspect every text field, read passwords, and click buttons autonomously. Malicious APKs use this to auto-grant themselves further permissions and log banking keystrokes.
SMS & 2FA Codes (READ_SMS, RECEIVE_SMS)
SMS access lets an app read and receive text messages — including one-time passcodes used for two-factor authentication. This is how banking Trojans bypass SMS-based account verification. Only default SMS messengers should ever request this.
Contacts (READ_CONTACTS)
This hands over names, numbers, and emails for everyone in your address book. Messaging and dialer apps need it. A flashlight, wallpaper app, or single-player game has zero legitimate need for contacts, making this a classic data-harvesting indicator.
System Alert Window (Draw Over Other Apps)
Allows an app to display overlay windows over whatever app is currently running. Used legitimately by chat heads (e.g. Messenger), but frequently abused to inject invisible overlay screens that capture banking passwords or trick you into clicking "Grant Admin".
Precise & Background Location
Fine-grained location tracks you down to a specific room or street corner. Navigation and ride-hailing apps need it while open. If an app requests background location (tracking when closed), question why an offline tool or utility needs to know your coordinates 24 hours a day.
Camera & Microphone
Grants continuous access to lens and audio recording hardware. Video calling and camera tools need it, but standalone photo editors only require storage read access to existing files, not live microphone recording.
Why this matters even more with Sideloaded .APK files
Apps downloaded from third-party APK sites, Telegram channels, or forum links bypass Google Play Protect scanning during publication. A modified version of a popular game (Mod APK) or unofficial WhatsApp fork often contains altered code designed to harvest telemetry or push persistent adware. Always run the permission list through this Risk Calculator before tapping install.