Is YMusic safe? APK source, permissions and evidence

What this project actually checked

The ARM64 file from the publisher-linked GitHub release was retrieved on 25 October 2026. Its manifest was parsed without running the app.

Checked version

4.0.12 · code 16

Declared minimum

Android 7.0 (API 24)

File size

9.66 MB · 9,662,095 bytes

Publisher attribution

YMusic project

Package identity

io.ymusic.android

Native libraries in this file

arm64-v8a

File variant checked

Publisher filename: arm64; other variants not inspected

Target / compile SDK

35 / 36

Publisher release date

2026-10-24

Primary release notes

Publisher release notes available

Source inspected

25 October 2026

App test / malware scan

Not performed

Understand the file fingerprint

SHA-256 identifies the exact bytes inspected. If a newly downloaded copy has a different hash, first check whether the publisher changed the file or you chose another variant. A matching hash establishes a byte match with this dated observation; it is not a malware verdict.

Android uses signing identity when installing updates. A certificate subject can be self-declared. The extracted fingerprint is useful for later comparison, but a complete signature check and a trusted signing-history comparison are still needed. We do not claim the developer’s legal identity has been independently verified.

Review permissions in context

The APK manifest declares the permissions below. A declaration is not proof that every permission is granted or exercised on every Android version.

Files, media and network

Internet, connection state, external storage and audio-media access relate to online playback and local-file tasks. Check the runtime requests on your phone.

Background work and app updates

Wake lock, foreground services, notification and package installation requests can affect continuing work or updates. Allow only the specific behavior you intend.

Privacy-sensitive declarations

The checked V4 manifest also declares camera and biometric permissions. A declaration does not prove when a feature uses them. Read each runtime prompt and the current project policy before granting access.

Read the app’s privacy policy separately

Read the V4 project’s current terms and privacy information before using account features. Review what the project says about data handling, diagnostics and third-party services. An older V3 privacy page is not a current policy for every V4 feature.

Permission declarations show what an app may request, not when it exercises that access. Read each Android prompt in the context of the feature you are using. Stop if a request is unexpected, and do not give this website your Google or YouTube password.

Publisher descriptions, source code and a file hash can inform the decision, but they do not replace an independent behavior audit. The evidence policy distinguishes those checks.

Keep Android’s protections active

Use the publisher source, read installation warnings, and keep Google Play Protect enabled. It checks for harmful behavior and can warn, block, disable or remove apps. The absence of a warning does not guarantee safety.

Grant only the permissions needed for the task you choose. Stop if a request is unexpected or does not make sense. Do not grant accessibility, device-administrator or other broad control merely because an unrelated download guide says it is required.

Follow the installation guide to keep sideloading permission limited to the app opening the APK, then turn that permission off afterward.

Safety and permission to use content are separate

The publisher states that YMusic is independent of YouTube and that users must follow applicable rules and content permissions. Review YouTube’s terms and save only content you have permission to download. No legal conclusion about your personal use is made here.

For a supported Google service route, see YMusic compared with YouTube Music. For installation or playback failures, use the troubleshooting guide instead of disabling security features.