How to Download Minecraft Addons Safely (and Spot Fake Download Sites)

Minecraft addons are free, which makes them a favorite bait for sketchy sites. Most players who get into trouble never meant to download anything dangerous; they just tapped the wrong green button. A few simple rules will keep your phone and account safe.

Rule 1: An addon is never an APK or an EXE

Real Minecraft Bedrock content comes as .mcaddon, .mcpack, .mcworld or .mctemplate files, or occasionally a .zip containing those. If a site asks you to install an .apk on Android or run an .exe on Windows to "unlock" an addon, close it. That is not an addon.

Rule 2: Know what the real download button looks like

Ad-heavy sites often place large, flashing "Download" buttons around the real link. Signs that a button is an ad:

• It says something like "Start Download", "Fast Download" or "Download Now" in a big colorful box that looks different from the site's design.
• Tapping it opens a new tab to an unrelated app store page or a "your phone is infected" warning.
• It asks for notification permission.

Never allow notifications from a download site. That is how spam pop-ups end up on your lock screen.

Rule 3: Avoid endless link shorteners

Some uploaders send you through several link shortener pages, each with a countdown and more ads, before you reach the file. Beyond being annoying, these pages are where most malicious redirects happen. If you hit a second or third shortener, back out and look for the addon on its original page.

Rule 4: Get addons from the original creator

The two biggest trusted sources for Bedrock addons are CurseForge and MCPEDL. Files on CurseForge are scanned, and the creator's profile shows their other projects and download counts. Reuploads on random sites are often outdated, sometimes broken, and occasionally modified.

Rule 5: Never enter your Microsoft account details

No free addon needs your Microsoft or Xbox login. Sites that promise free Minecoins, Marketplace content or "premium addons" in exchange for signing in are phishing pages. Minecraft itself handles your login; an addon file never will.

Rule 6: Check the file size

Most addons are between a few hundred kilobytes and around 50 MB. A tiny file for a "huge" pack, or a huge file for a tiny addon, is worth a second look.

What to do if you clicked something bad

1. Do not install anything the page downloaded. Delete it from your downloads.
2. In your browser settings, remove notification permission for any site you do not recognize.
3. If you entered a password anywhere, change it immediately and turn on two-step verification.