Is YMusic safe? APK source, permissions and evidence

What this project actually checked

The exact file linked from the publisher homepage was retrieved on 13 October 2026. Its manifest was parsed without running the app.

Checked version

3.9.23 · code 4498

Declared minimum

Android 5.0 (API 21)

File size

8.79 MB · 8,792,888 bytes

Publisher attribution

Khang NT

Package identity

com.kapp.youtube.final

Native libraries in this file

arm64-v8a, armeabi-v7a

File variant checked

Publisher filename: arm64; other variants not inspected

Target / compile SDK

29 / 35

Publisher release date

Not confirmed

Primary release notes

Not located

Source inspected

13 October 2026

App test / malware scan

Not performed

Understand the file fingerprint

SHA-256 identifies the exact bytes inspected. If a newly downloaded copy has a different hash, first check whether the publisher changed the file or you chose another variant. A matching hash establishes a byte match with this dated observation; it is not a malware verdict.

Android uses signing identity when installing updates. A certificate subject can be self-declared. The extracted fingerprint is useful for later comparison, but a complete signature check and a trusted signing-history comparison are still needed. We do not claim the developer’s legal identity has been independently verified.

Review permissions in context

The APK manifest declares the permissions below. A declaration is not proof that every permission is granted or exercised on every Android version.

Files, media and network

Internet, connection state, external storage and audio settings relate to online playback and local-file tasks. Check the runtime requests on your phone.

Background work and app updates

Wake lock, foreground service, battery-optimization requests and package installation requests can affect continuing work or updates. Allow only the specific behavior you intend.

Privacy-sensitive declarations

Phone state, approximate location, package visibility and an advertising identifier deserve attention. Publisher explanations are claims, not a traffic audit.

Read the app’s privacy policy separately

The publisher policy reports device-related data, approximate location, an advertising identifier and analytics. It also describes additional account data when signed in, and names third-party services. Those are publisher statements, not observations from traffic analysis.

Read YMusic’s privacy policy before deciding whether its data practices suit you. Our own website privacy policy describes this guide site and does not replace the app’s policy.

We do not collect Google or YouTube passwords. Do not enter them into this website or send them in a support request. Account sign-in behavior inside YMusic has not been tested by this project.

Keep Android’s protections active

Use the publisher source, read installation warnings, and keep Google Play Protect enabled. It checks for harmful behavior and can warn, block, disable or remove apps. The absence of a warning does not guarantee safety.

Grant only the permissions needed for the task you choose. Stop if a request is unexpected or does not make sense. Do not grant accessibility, device-administrator or other broad control merely because an unrelated download guide says it is required.

Follow the installation guide to keep sideloading permission limited to the app opening the APK, then turn that permission off afterward.

Safety and permission to use content are separate

The publisher states that YMusic is independent of YouTube and that users must follow applicable rules and content permissions. Review YouTube’s terms and save only content you have permission to download. No legal conclusion about your personal use is made here.

For a supported Google service route, see YMusic compared with YouTube Music. For installation or playback failures, use the troubleshooting guide instead of disabling security features.