APK Analyzer
Browser-based Android APK deep analysis: AndroidManifest.xml decode, permission risk grading, v1/v2/v3 signature detection, DEX class listing, native lib breakdown, hardcoded-secrets scan, and full archive tree — 100% client-side.
How to Use
- Drop any .apk (or .aab / .ipa / .zip) file onto the dropzone.
- The Overview tab shows package ID, version, target SDK, signing schemes, sizes.
- Permissions tab grades each uses-permission as dangerous / signature / normal.
- DEX + Native tabs surface classes.dex files (open in Binary Explorer) and lib/{arch}/*.so.
- Secrets tab regex-scans every text file for AWS / GitHub / Google / Slack tokens, JWTs, private keys.
What it analyses
How APK analysis works
An APK is a ZIP archive with a known internal layout. The central directory at the end of the file lists every entry — AndroidManifest.xml, classes.dex, resources.arsc, res/, lib/, assets/, META-INF/. Most entries are deflate-compressed and inflated by the browser's built-in DecompressionStream. The manifest itself is stored in AXML — Android's binary XML format with a string pool, resource-ID map, and chunked element tree — which this tool decodes back to readable XML. Permissions are extracted from <uses-permission> tags and matched against AOSP's risk database. Signing is detected by checking for the APK Sig Block 42 magic before the central directory (v2/v3) and the META-INF/*.RSA|DSA|EC files (v1). The secrets scan applies the same regex patterns used by malware-triage tools.
Frequently Asked Questions
Does it upload my APK?
No. Everything — ZIP extraction, AXML decoding, secrets scan — runs inside your browser.
IPA support?
Yes. iOS .ipa is a ZIP too, so the tree view + plist files + secrets scan work. APK-specific tabs (AXML, DEX) are skipped.
How big can the APK be?
The whole file is loaded into memory for ZIP parsing. Several hundred MB is fine. Multi-GB game APKs may push browser limits.
Can it decompile DEX to Java?
Not directly — but the DEX tab links each classes.dex into Binary Explorer where you get Dalvik bytecode disassembly + the stack-machine decompiler.
Why is my AndroidManifest.xml binary?
Android compiles XML resources into a custom binary format ("AXML") at build time. This tool decodes it back to readable XML.
Common Use Cases
Malware triage
Spot dangerous permissions, native libs, embedded URLs, hardcoded keys in seconds.
Privacy audit
Check what data an app could access and what trackers it pulls in.
Reverse engineering
Pair with Binary Explorer for DEX disassembly + Dalvik decompilation.
Supply chain check
Verify signing certificate, check for known-bad SDKs in the resource tree.
Last updated: