APK Analyzer
Browser-based Android APK deep analysis: AndroidManifest.xml decode, permission risk grading, v1/v2/v3 signature detection, DEX class listing, native lib breakdown, hardcoded-secrets scan, and full archive tree — 100% client-side.
How to Use
- Drop any .apk (or .aab / .ipa / .zip) file onto the dropzone.
- The Overview tab shows package ID, version, target SDK, signing schemes, sizes.
- Permissions tab grades each uses-permission as dangerous / signature / normal.
- DEX + Native tabs surface classes.dex files (open in Binary Explorer) and lib/{arch}/*.so.
- Secrets tab regex-scans every text file for AWS / GitHub / Google / Slack tokens, JWTs, private keys.
What it analyses
How APK analysis works
An APK is a ZIP archive with a known internal layout. The central directory at the end of the file lists every entry — AndroidManifest.xml, classes.dex, resources.arsc, res/, lib/, assets/, META-INF/. Most entries are deflate-compressed and inflated by the browser's built-in DecompressionStream. The manifest itself is stored in AXML — Android's binary XML format with a string pool, resource-ID map, and chunked element tree — which this tool decodes back to readable XML. Permissions are extracted from <uses-permission> tags and matched against AOSP's risk database. Signing is detected by checking for the APK Sig Block 42 magic before the central directory (v2/v3) and the META-INF/*.RSA|DSA|EC files (v1). The secrets scan applies the same regex patterns used by malware-triage tools.
About the APK Analyzer
Working on image, audio and file tasks? The APK Analyzer is a free browser tool that gives you the answer in seconds. Browser-based Android APK deep analysis: AndroidManifest.xml decode, permission risk grading, v1/v2/v3 signature detection, DEX class listing, native lib breakdown, hardcoded-secrets scan, and full archive tree — 100% client-side.
How it works
Enter what you have and read the result as it updates live. It all runs on your own device, so it is quick and private, with nothing to install.
Want the deeper story? The Knowledge Base explains the ideas behind the tools in more detail.
Frequently Asked Questions
Does it upload my APK?
No. Everything — ZIP extraction, AXML decoding, secrets scan — runs inside your browser.
IPA support?
Yes. iOS .ipa is a ZIP too, so the tree view + plist files + secrets scan work. APK-specific tabs (AXML, DEX) are skipped.
How big can the APK be?
The whole file is loaded into memory for ZIP parsing. Several hundred MB is fine. Multi-GB game APKs may push browser limits.
Can it decompile DEX to Java?
Not directly — but the DEX tab links each classes.dex into Binary Explorer where you get Dalvik bytecode disassembly + the stack-machine decompiler.
Why is my AndroidManifest.xml binary?
Android compiles XML resources into a custom binary format ("AXML") at build time. This tool decodes it back to readable XML.
How do I use the APK Analyzer?
Simply type your numbers and read the result, which refreshes the instant you change something. There is nothing to submit and nothing to wait for.
Do I need to install or sign up for anything?
Not at all — it runs in the browser with nothing to install and no account. After it loads once, it even works without an internet connection.
Is my information private?
Yes. Everything happens in your browser. Nothing you type is sent to a server or saved anywhere.
Common Use Cases
Malware triage
Spot dangerous permissions, native libs, embedded URLs, hardcoded keys in seconds.
Privacy audit
Check what data an app could access and what trackers it pulls in.
Reverse engineering
Pair with Binary Explorer for DEX disassembly + Dalvik decompilation.
Supply chain check
Verify signing certificate, check for known-bad SDKs in the resource tree.
Last updated: