JumPHP runtime on Android: install the app

On a phone, a web page cannot reach your own network (home Wi-Fi, VPN, a server that only accepts your address). The JumPHP runtime for Android is a small app that does it for the JumPHP applications you open in your browser, only with your permission. It is not on Google Play: you install an .apk file yourself. This page explains every box Android asks you to tick.

Android says it may be harmful? It is not a virus

Your browser, Android or Google Play Protect may say that the file "can harm your device", "is not commonly downloaded" or "comes from an unknown source". That is normal and expected: it only means the app is not distributed by Google Play and is signed with its own key. What you can check:

the source code is public: git.jumphp.net/jumphp/jumPhp (folder apps/runtime-android);
it listens only on the phone itself (127.0.0.1), answers only the pages of jumphp.net, and connects only where you tap Always or This time;
it never reads your files, contacts or messages and never records what goes through it (only a journal: site, application, target, time, volume);
you can revoke every permission, or uninstall the app, at any time;
fingerprint (SHA-256) of its signing certificate: D5:4C:E2:69:90:7A:FE:E5:0C:1F:E6:73:70:98:38:DD:15:16:29:CC:B0:35:4C:ED:FB:0F:98:F6:E6:5D:15:AE.

Install, step by step

Download jumphp-runtime-android.apk from the releases page (the newest runtime-android-v…). Chrome may ask "This type of file can harm your device": tap Keep (or Download anyway).
Open the downloaded file. Android says "For your security, your phone is not allowed to install unknown apps from this source": tap Settings and switch on Allow from this source (it is for your browser, e.g. Chrome). If no window opens: Settings → Apps → Special app access → Install unknown apps → your browser → Allow. Go back and tap Install.
If Google Play Protect shows "Blocked", "App blocked to protect your device" or "Scan app?": tap More details → Install anyway (or Install without scanning). On Xiaomi an extra security question may appear: accept it.
Open JumPHP runtime. Allow notifications when Android asks (Android 13+): the questions ("Allow this application?") arrive as notifications.
It starts by itself (State: ON, a notification stays visible). Tap Keep it running and choose Not optimised / Unrestricted for the battery, so that Android does not stop it.
On Xiaomi, Huawei, Oppo, Vivo, OnePlus, Samsung…, also tap Start with the phone (autostart) and switch it on: otherwise the phone does not restart the app after a reboot.
Back on the application's page, the light turns orange: tap Allow this app. A notification asks "Allow …?": tap it and choose Always. The light turns green.

Do I need the developer mode?

No. Developer options and USB debugging are not needed to install an .apk from your browser. Only the permission "Install unknown apps" for your browser (step 2) is. You can switch it off again afterwards.

Updates

The app looks for a newer version every 6 hours (and when you open it). A notification and an Install button appear: Android checks that the new file is signed by the same key, you confirm, done.

Problems

App not installed: an older copy signed with another key is on the phone. Uninstall it, then install again.
It stops after a reboot: switch on autostart (step 6) and the battery setting (step 5).
The light stays red: open the app (it must say State: ON), then reload the page; or tap Start / install the app on the page.
The question does not show: allow the app's notifications (Settings → Apps → JumPHP runtime → Notifications).

On iPhone this is not possible (no background service with a local port): the application keeps connecting through the jumphp.net server.