RN
Search for a porn app and every result has the same footnote: you will have to install it yourself, from a website, outside the store. That footnote is not a detail. It is the entire security story of this category, and it is why the answer to "which one is best" is usually "none of them".
Why they are not in the store
Both major mobile platforms exclude pornographic content from their app stores as a matter of policy. This is not enforcement failure or a temporary position — it is a deliberate rule, and it has held for as long as the stores have existed.
Everything follows from that. An adult app cannot use store distribution, so it is either an Android package downloaded from a website, or a store-listed app whose adult content arrives after installation through a mechanism the reviewers did not see. Both of those are worse than they sound.
What the store was actually doing for you
People think of app review as taste policing. Its more important function is mundane: a listed app has a verified publisher identity, an update channel tied to that identity, a scan for known malicious behaviour, and a revocation path if it turns out badly.
Sideloading removes all four at once. You are trusting a package from a web server with no independent check on who built it, no guarantee the next update comes from the same people, and no mechanism to pull it back if it goes wrong. That is a lot of trust to extend to a website whose business model you do not know.
There is a second-order problem too. Once someone has enabled installing from unknown sources, they have enabled it — and the next package, from a worse source, installs on the same permission.
What an installed app can see
A browser tab is confined. It cannot read your other apps' data, cannot enumerate your files, cannot run when closed, and cannot see anything about the device that you have not granted per-site.
An installed application starts from a much larger surface. It can request storage access, run background services, hold a persistent notification channel, read the list of installed packages on some configurations, and maintain an identifier that survives clearing your browser. Every one of those is a legitimate capability that legitimate apps use — and every one is also a capability that a browser tab denies by default, for free, without you having to evaluate anyone's intentions.
The specific mismatch worth noticing: you are considering handing that surface to a category of software you found on a site you had not heard of, to view content you would rather nobody knew you were viewing. Those two facts point in opposite directions.
The privacy problem the app makes worse, not better
The pitch for these apps is usually discretion — a PIN lock, no browser history, a disguised icon.
Consider what an installed app leaves behind that a tab does not. It is in the app list. It appears in battery and data usage breakdowns, under its own name, historically. It may hold notification permission. It appears in backup manifests. It survives every history-clearing action a person takes because none of those touch installed applications.
Private browsing plus a bookmark does better on every one of those axes, and the PIN a person actually wants is the device lock, which is already there.
What replaced them
The reason nobody had to solve this problem is that the mobile web caught up.
Adult sites shipped responsive layouts years ago, video plays inline, and installable web apps can sit on a home screen with an icon and a name you choose without any of the above being true. Add-to-home-screen is a bookmark with ambition, and for this use case that is exactly the right amount of software.
The features the 2017 app roundups sold — autoplay feeds, casting to a television, an integrated player, offline saving — are either standard on the mobile web now or handled by the operating system. Casting in particular is a system-level function on both platforms and does not need an application to broker it.
If you are going to do it anyway
Some people want offline libraries, or a specific service with a genuinely good client, and that is a reasonable position. In that case:
- Install from the operator's own domain and nowhere else. Aggregator sites that repackage adult apps are the single most common distribution point for tampered builds of anything.
- Read the permission list at install and again after an update, and treat any request that has nothing to do with playing video as a reason to stop.
- Turn install-from-unknown-sources back off afterwards. On current Android versions the permission is per-app, which is a real improvement — use it that way.
- Do not use a device you share, and do not use a work device at all.
- Prefer a service you already have an account with over an aggregator app that indexes many sites. The second kind has no relationship with the content it serves and no reason to still exist next year.
Where to browse instead
Every listing in this directory works in a mobile browser, which is the point. The free tube sites and free video sites sections are the obvious starting points, and anything you use regularly can go on the home screen without installing a thing.