APK/AAB Analyzer
Drop in an .apk or .aab and get its manifest details, signing info, and a size breakdown by category — parsed entirely in your browser, nothing ever uploaded.
Your APK/AAB never leaves this device — it's read and parsed entirely in your browser.
WHAT_YOU_GET
MANIFEST_DETAILS
Package name, version code/name, min/target SDK, every uses-permission, and the list of activities/services/receivers/providers — parsed straight out of the APK's binary-XML manifest.
SIGNING_INFO
Detects META-INF/*.RSA, .DSA, or .EC signature files and, when the certificate bytes can be confidently isolated, computes a SHA-256 fingerprint. No fingerprint is ever shown unless it's been computed correctly.
SIZE_BREAKDOWN
Entries grouped into DEX code, resources, assets, native libraries (per ABI), signing, and compiled resources — with a percentage of total size for each.
AAB_SUPPORT
Detects Android App Bundles, lists dynamic feature modules, and gives the same size breakdown. AAB's protobuf manifest isn't parsed yet — that's flagged clearly rather than guessed at.
NOTHING_UPLOADED
The file is read and parsed with the ZIP/binary-XML logic running entirely in your browser. Your APK/AAB never leaves your device.
FAQ
Is my APK or AAB uploaded anywhere?
No. The file is read with the File API and parsed entirely client-side — ZIP extraction, binary XML manifest parsing, and signature inspection all run in your browser.
How is the manifest read without a plain-XML AndroidManifest.xml?
APK manifests are stored in a compact binary format (AXML) — a string pool plus a stream of start/end element and attribute chunks. This tool implements a minimal parser for that chunk format to pull out the package name, version, SDK levels, permissions, and component names.
Why isn't there always a certificate SHA-256 fingerprint?
Computing it correctly requires locating the exact DER bytes of the X.509 certificate inside a PKCS#7 signature block. When that can be done confidently, a real SHA-256 is shown. When it can't, this tool says so explicitly instead of risking a wrong fingerprint.
Why is AAB manifest parsing more limited than APK?
An .aab's AndroidManifest.xml is serialized protobuf (aapt2's Resources.proto), a different and larger parsing job than APK's binary XML. For now, AAB analysis covers file size breakdown and the list of dynamic feature modules; manifest field extraction is not yet implemented.
What counts as 'Native libraries' in the size breakdown?
Everything under lib/, broken out per ABI folder (armeabi-v7a, arm64-v8a, x86, x86_64) so you can see which architectures are inflating your package size.