APK Analyzer Online
Drop an Android APK to read its manifest as XML, the permissions it asks for, which components are exported, DEX method counts, where the bytes go and how it is signed. No Android SDK, no account and no upload.
APK Analyzer & APK Viewer for VS Code and Cursor, free
- Click an .apk, .aab, .apks or .xapk file in the Explorer and it opens, read-only and offline, with no Android SDK and no Java.
- Method counts as a tree with totals per package, and every class the DEX files define.
- A hex view of the whole file or of the unpacked bytes of any entry.
Optional Zovo Pro, USD 19 once: compare two APKs, export the report as JSON, Markdown or CSV, and find in DEX. 3 free tries for each.
Drop an .apk file here
or
Android .apk, .aab, .apks and .xapk files of any size. Only the manifest, DEX files and signing data are read.
Notes
Open this in VS Code or Cursor
This page runs the readers of the free APK Analyzer extension. In VS Code and Cursor it opens an .apk the moment you click it in the Explorer, and adds a method count tree by package and a hex view of the whole file or of any entry.
Free, MIT license. About APK Analyzer for VS Code.
Zovo Pro
Compare two APKs, export the report and find in DEX. Zovo Pro, USD 19 once.
In the APK Analyzer extension, Zovo Pro compares two APKs (size by file and folder, permissions, components, SDK levels, signing and method references per package, with a Markdown report), exports the whole analysis as JSON, Markdown or CSV, and finds a class, method, field or string in every DEX file. Each Pro tool works 3 times for free. One payment covers the Pro tools in 22 Zovo extensions. Everything that is free stays free.
After a card payment you get a key on the page. With GitHub Sponsors you sign in from the extension. Details on the Zovo Pro page.
Related tools
- JAR Viewer & Java Decompiler. Opens .jar and .class files in VS Code.
- ZIP Viewer & ZIP Explorer. Lists and extracts ZIP, JAR, TAR and GZ archives in VS Code.
- ELF and PE Viewer. Reads the headers, sections and symbols of native libraries and executables.
- Hex Viewer Online, free in your browser.
- SQLite Viewer Online, free in your browser.
- Excel Viewer Online, free in your browser.
Questions
Is my APK uploaded anywhere?
No. The page reads the file inside this tab, in a background worker of the page. Its Content Security Policy sets connect-src to none, and the reader has no network code. Open the Network tab of your browser tools and you will see no request when an APK opens.
What does it show?
The package name, versionName and versionCode, min, target and compile SDK with the Android version, the app label when it is a plain string, the debuggable, allowBackup and cleartext traffic flags, every permission with the dangerous ones flagged, each activity, service, receiver and provider with its exported flag and the reason, DEX method counts, the size of every folder, file type and file, native libraries per ABI, and the signing schemes with the certificate.
How is the exported flag worked out?
If the manifest sets android:exported, that value is shown. Without it, a component with an intent filter counts as exported when targetSdk is below 31, and Android 12 and newer refuse to install an app that leaves it out. Without an intent filter the default is not exported. The Why column says which rule applied, and the launcher activity is marked.
What is the 65,536 method limit?
One DEX file can address at most 65,536 method references. The DEX tab shows the references in each classes.dex file and its share of the limit, with field, string, type and prototype counts. Apps above the limit split their code over several DEX files.
Can it open big APKs and App Bundles?
Yes. Only the central directory, the manifest, the DEX files and the signature data are read, in 64 KB blocks, so a large APK opens without reading its assets. For an .aab bundle the files, sizes, DEX counts, native ABIs and signing are shown; its manifest is a protocol buffer, which is not decoded. For .apks and .xapk files the APKs inside are listed and the base APK is read.
Does it check the signature?
No. It shows what is there: v1 (JAR) signature files, the APK Signing Block with its v2, v3 and v3.1 blocks, and the signer certificate with its SHA-256 and SHA-1, subject, issuer, validity and key type. It does not verify the signatures.
Is a damaged or hostile APK safe to open?
Every count and offset is checked against the bytes that are really there, an entry is unpacked only up to the size its header gives, so a zip bomb is stopped early, and the reader is stopped after 30 seconds. Values are written as plain text, never as HTML.
What is free and what is Zovo Pro?
Everything on this page is free, and the APK Analyzer extension for VS Code is free too. Comparing two APKs, exporting the report and finding text in DEX files are Zovo Pro in the extension, with 3 free tries each. One USD 19 payment covers the Pro tools in every Zovo extension.