F-Droid vs Google Play Store: A 2026 Comparison for Privacy-Conscious Users
A 2026 side-by-side comparison of F-Droid and the Google Play Store on policy, anti-features, update model, catalog size, and security guarantees. Ten criteria, clear verdict.
Marcus Fielding 11 mai 2026
There is a recurring question we get from new Android power users: do I actually need to install F-Droid, or is the Play Store enough? The honest answer in 2026 is that for most privacy-conscious users the right answer is “both, with rules”. This is a comparison of what each store actually does, where they differ, and where the differences matter.
We are not going to pretend the Play Store is universally bad. It is the default, it has by far the largest catalog, and Play Protect catches a meaningful fraction of in-the-wild malware. We are also not going to pretend F-Droid is a drop-in replacement: it explicitly does not host proprietary apps, which means several entire categories (banking, popular video streaming, some workplace tools) are not present and never will be.
The basics of each store
Google Play Store is the default app store shipped on certified Android devices. It is operated by Google, requires Google Mobile Services to function, and uses a centralised review and distribution pipeline. Developers upload signed binaries directly; Google does not rebuild them. Play Protect runs both on-device and server-side scans against the binaries. The catalog covers approximately three million apps depending on how you count regional variants.
F-Droid is an independent app store run by a non-profit, focused on free and open-source software. The catalog is curated: every app is reviewed for licence compliance, and every binary is rebuilt by the F-Droid build farm from a tagged commit on the project’s public source repository. The result is signed by F-Droid’s own key, not the developer’s. The catalog is approximately 4,500 apps as of mid-2026.
Both are legal. Both are mainstream within their respective audiences. The differences are in policy, not legitimacy.
Comparison table
| Criterion | F-Droid | Google Play Store |
|---|---|---|
| Licence policy | Free / open source only | Any licence accepted |
| Binary provenance | Rebuilt from source by F-Droid build farm | Developer-uploaded |
| Signing key | F-Droid key | Developer key |
| Anti-feature labels | Yes, per app | No |
| Update cadence | 1 to 5 days behind upstream typically | Same-day or within hours |
| Catalog size | ~4,500 apps | ~3,000,000 apps |
| Malware detection model | Source review + build farm | Play Protect (heuristic + reputational) |
| Banking apps | No | Yes |
| Payment apps (Google Pay etc.) | No | Yes |
| Telemetry from store client | Minimal | Standard Google telemetry |
| Account required | No | Google account required |
| Auto-updates | Optional, off by default | Default on |
The table flatters F-Droid on transparency and the Play Store on scale. That asymmetry is the whole story.
Anti-features: F-Droid’s most underrated feature
The single feature that makes F-Droid worth installing even alongside the Play Store is anti-feature labels. Every app page tells you, in plain language, which behaviours the app exhibits that a privacy-conscious user might want to avoid: tracking, advertising, non-free dependencies, non-free network services, upstream non-free addons, known vulnerabilities, and so on.
This is information the Play Store does not surface. Two examples from the catalogue at time of writing:
- OsmAnd is labelled with no anti-features. The map data fetcher uses OpenStreetMap servers, the routing is local, and the app does not call out to advertising networks.
- The official YouTube client (on Play) is not on F-Droid. NewPipe (an F-Droid alternative) is labelled with a single anti-feature: NonFreeNet, indicating that it talks to a non-free network service (YouTube). That is honest disclosure: you know what you are getting.
For comparison, the Play Store does require developers to declare “Data safety” in a structured form. In practice the form is self-attested, the granularity is coarser than F-Droid’s anti-features, and there is no rebuild-from-source check to verify that the declared behaviour matches the binary.
Update cadence and trust trade-offs
The F-Droid build pipeline introduces latency. When a developer pushes a new release tag, F-Droid’s build farm fetches the source, builds it, signs it, and publishes. That round trip is typically one to five days. For apps with complex build systems or new toolchain dependencies, it can be longer. For security-critical apps, this matters.
The trade-off is provenance. An F-Droid binary is reproducible from public source. A Play Store binary is whatever the developer uploaded, which may or may not match their public repository, if they have one. For most apps you will not care. For something that holds your password vault or your messaging keys, you might.
Two practical patterns we use:
- For password managers (Bitwarden, KeePassDX) we use the F-Droid build and accept the latency. The benefit is that the binary signing chain is independent of the developer’s own infrastructure.
- For banking apps we use the Play Store, because there is no alternative. We isolate them in a Shelter work profile so they do not see our main-profile data.
Catalog size: where F-Droid hits its ceiling
The F-Droid catalogue covers roughly 4,500 apps. The categories most thoroughly represented are: developer tools, privacy and security utilities, RSS and reading apps, file synchronisation, document editing, calculators, and OpenStreetMap-based maps.
Categories that are thin or absent: large social-media clients, most banking apps, most streaming video services, most workplace messaging (Slack, Teams), commercial productivity (Microsoft 365, full Google Workspace), and large commercial games. Some of these have unofficial open-source clients on F-Droid, with varying quality and varying robustness against API changes from the upstream service.
For most readers, this means a hybrid model: F-Droid as a primary source for tooling and utilities, Play Store as a fallback for the specific proprietary apps you cannot replace. Some readers go further and run a Shelter work profile or an Aurora Store install (a F-Droid app that proxies the Play Store catalog with an anonymous account) to keep the Play Store off their main profile entirely. That sits on the boundary of what we cover under legitimate sideloading, and it is a reasonable place to land.
Security model: two different theories
The Play Store’s security model is reputational and behavioural. Play Protect scans installed apps and binaries against Google’s ever-growing fingerprint database. It catches a meaningful fraction of in-the-wild malware: roughly 1 to 2 percent of installs trigger a warning per Google’s own annual reports.
F-Droid’s security model is structural. Apps are only accepted if their source is publicly auditable and their binary is reproducible from that source. Tracking SDKs, undisclosed network calls, and non-free dependencies are surfaced as anti-features. There is no behavioural scanner equivalent to Play Protect; the model is to make tampering visible, not to catch it after the fact.
In practice, both models miss things. The Play Store has shipped malware with millions of installs more than once in the last several years; F-Droid has shipped apps with security issues that were not anti-feature labelled because the labelling depends on source review catching them. The honest comparison is that the Play Store is better at scale and F-Droid is better at provenance.
Verdict: run both, with rules
Run F-Droid as your primary source for:
- Developer utilities and power-user tooling
- Privacy-first apps (Tor Browser, Signal via F-Droid where available, RethinkDNS)
- Password managers and security tools
- Open-source replacements for mainstream apps (NewPipe, Markor, Simple Mobile Tools forks)
Run the Play Store for what you cannot get elsewhere:
- Banking, payment, and government apps
- Workplace apps your employer mandates
- Specific proprietary apps with no viable open-source replacement
For the proprietary tail, consider isolating Play Store apps in a work profile with Shelter. This pattern keeps the proprietary stack from sharing identifiers and contacts with your main profile while still letting you use what needs to be used.
If you want to go further, look at GrapheneOS, which supports running the full Play Store as a “sandboxed” install where the Play Services stack runs as a regular app without privileged access. That is the cleanest version of the hybrid model, but it requires moving to a Pixel device and reflashing.
FAQ
Can I use F-Droid and the Play Store on the same phone?
Yes. F-Droid installs as a normal app and coexists with the Play Store. The two stores are independent and update apps installed through them separately. Most privacy-conscious users we know run both: F-Droid for open-source replacements and the Play Store for banking, work apps, and anything proprietary that has no F-Droid equivalent.
Is F-Droid safer than the Play Store?
In a strict sense yes, because F-Droid builds every binary from source on its own build farm and refuses apps with undisclosed tracking. But the Play Store has Play Protect, a vastly larger automated detection pipeline, and an order of magnitude more eyes. The honest answer is that F-Droid has stronger transparency guarantees and the Play Store has stronger scale-based malware detection. For privacy-conscious users, F-Droid wins. For users who cannot evaluate trust themselves, the Play Store is still the safer default.
Why are F-Droid apps often older than their Play Store version?
F-Droid does not accept developer-uploaded binaries. Every release is rebuilt by the F-Droid build farm from the corresponding tagged source commit and then signed with the F-Droid key. That pipeline adds one to five days of latency for most apps and longer for projects that change their build system frequently. The trade-off is that the F-Droid binary is reproducible from public source code.
Does F-Droid have a banking or Google Pay equivalent?
No. Banking apps, payment apps, and apps that require Google Mobile Services are not available on F-Droid. F-Droid is open-source only, and these apps are proprietary by design. For banking, you either keep the Play Store installed, use the bank web portal, or move to a profile-isolated install (Shelter work profile) so that the proprietary stack does not have access to your main profile.
FAQ
- Can I use F-Droid and the Play Store on the same phone?
- Yes. F-Droid installs as a normal app and coexists with the Play Store. The two stores are independent and update apps installed through them separately. Most privacy-conscious users we know run both: F-Droid for open-source replacements and the Play Store for banking, work apps, and anything proprietary that has no F-Droid equivalent.
- Is F-Droid safer than the Play Store?
- In a strict sense yes, because F-Droid builds every binary from source on its own build farm and refuses apps with undisclosed tracking. But the Play Store has Play Protect, a vastly larger automated detection pipeline, and an order of magnitude more eyes. The honest answer is that F-Droid has stronger transparency guarantees and the Play Store has stronger scale-based malware detection. For privacy-conscious users, F-Droid wins. For users who cannot evaluate trust themselves, the Play Store is still the safer default.
- Why are F-Droid apps often older than their Play Store version?
- F-Droid does not accept developer-uploaded binaries. Every release is rebuilt by the F-Droid build farm from the corresponding tagged source commit and then signed with the F-Droid key. That pipeline adds one to five days of latency for most apps and longer for projects that change their build system frequently. The trade-off is that the F-Droid binary is reproducible from public source code.
- Does F-Droid have a banking or Google Pay equivalent?
- No. Banking apps, payment apps, and apps that require Google Mobile Services are not available on F-Droid. F-Droid is open-source only, and these apps are proprietary by design. For banking, you either keep the Play Store installed, use the bank web portal, or move to a profile-isolated install (Shelter work profile) so that the proprietary stack does not have access to your main profile.