This is a step-by-step (ish) guide for how to obtain apps outside of the Google Play Store if you are using Android, or an Android variant (like GrapheneOS). These steps are going to focus on using the Accrescent app store, Obtainium and the Verified Apps app, which I feel to be an ideal solution when used properly. If you are using GrapheneOS, you will find the Accresent app store in your GrapheneOS app store (which has very, very few apps). If you are not using GrapheneOS, you can download Accrescent at https://accrescent.app.
If you are a total beginner, or you’re uncertain about your ability to follow the steps properly once you read through them, I feel like using Aurora Store is potentially a better option; using Obtainium safely requires some tech literacy. Many people use F-Droid, but the developers of GrapheneOS do not recommend it, and I personally trust them. (I know this is a whole can of worms. If you want to use F-Droid, I’m sure it’s fine.) Keep in mind that many proprietary apps will only be available via the Google Play Store. You will have to use Aurora for those or find alternative apps if you want to avoid the Play Store.
These are the steps I use to download, verify, and update my apps on GrapheneOS. Once installed, Obtainium will update your apps automatically for you. Follow the steps in order, as options that come first on the list are preferred:
-
If you’re on GrapheneOS, you can install Accrescent from the GrapheneOS app store. If you’re on another OS, you can find Accrescent at https://accrescent.app/.
-
If the app you’re trying to install is available in the GrapheneOS app store or Accrescent, download it there. If not (which is likely the case) go to step 2.
-
Install “AppVerifier” from Accrescent.
-
Download Obtainium (https://obtainium.imranr.dev) and verify it using AppVerifier.
-
Go to " Releases · privacyguides/verified-apps-android · GitHub " and click the “GET IT ON Obtainium” button. This will automatically connect to Obtainium to download the app. Check the posted signing key hash (which at the time of writing is “org.privacyguides.verifiedapps
40:5C:6B:D2:CA:7C:3A:AE:8F:46:3C:6F:8B:55:BC:F0:DD:AC:43:1C:5E:D8:EA:FF:65:D1:06:C9:81:7A:20:7F”) using AppVerifier. Once verified, you can use Verified Apps to check future downloads, as it has a larger app database. You can uninstall or disable the AppVerifier app at this time. -
Search https://apps.obtainium.imranr.dev/ to see if a config file is posted for the app you’re trying to install. You can also click the “+ Add” button in the Obtainium app and click “Crowdsourced app configurations” at the bottom of that screen. If the app you’re looking for is in the crowdsourced list, double check the address and website before using it; check that it links to an official developer website or to an official GitHub page or something similar. Clicking the link in the config database will open a .json config file in Obtainium and allow you to easily download the app. If it’s not on that site, try step 7.
-
Search the internet for something like “official (app name) apk download” or “github (app name) apk” to see if the official .apk file is posted anywhere by the developers. For most FOSS apps, this search will take you to either their official website that will have a download link or to their GitHub repository assets page. You ideally only want to download from the developer’s official site or GitHub. Often the developer website just links to GitHub. Again, double check these pages are official. Check things like number of stars on the repo and read through the readme. Once you’re sure it’s the correct app, copy the complete website into Obtainium. If you cannot find the .apk this way, move on to step 8.
-
Next step is to check the F-Droid website. If you find the .apk you need in F-Droid you can search it directly in the obtainium app search with the “F-Droid official” box checked as the source filter. You can click the link that comes up in Obtainium search to verify the download site again before you click download. (You do not need to install any F-Droid client, you can add F-Droid apps directly from Obtainium, and I recommend this approach.) It is preferred to find the direct .apk download link. Only use the F-Droid repos as a backup.
-
It is highly likely you will find most FOSS apps using these steps. There has only ever been one app that took me past these steps, and that .apk lived on Codeberg. There are various source filters in the Obtainium search. If you know where the .apk lives, you can just directly search for it through the Obtainium search by checking the correct source filter boxes.
-
Verify your app download:
Once you’ve found your .apk, added it to Obtainium, and started the install process, it is important to verify the authenticity of the app. Obtainium automates this with the help of the “Verified Apps” app. (Make sure you have Verified Apps installed before installing apps with Obtainium. If not, go back and install Verified Apps, then install the app you’re trying to install again. Obtainium will prompt you to share the app to “Verified Apps” to verify its authenticity. This is the default Obtainium behavior. Lots of apps are in the “Verified Apps” database, but some are not. In those cases, search for the hash online (the GitHub readme, the developer website, social media accounts of the project or devs, the GrapheneOS forum, the Privacy Guides forum). Sometimes it’s not possible to find the hash and you have to determine whether it’s worth trusting the authenticity of that app, but many FOSS .apks can be verified using Verified Apps. Once you have verified an .apk, future .apk updates will only be installed if they have the same signature.
This is roughly the process recommended by the GrapheneOS team. If I’m missing anything, feel free to update or comment. This is the process I use at the time of writing, but best practices can absolutely change over time.
Obtainium is not for complete “beginners” but it also should be possible for many people to learn as long as they are detail-oriented and have some moderate tech literacy for things like verifying the download source is authentic. (If you know you don’t know how to tell if a website is legitimate, then of course do not use this method and use a more centralized app source like Aurora or even F-Droid.)
Last edited by @dadnerd 2026-09-04T14:52:21Z