Looking inside an Android APK without installing it
An APK is the package an Android app is installed from. Before you install one from outside Google Play, or before you release your own build, it is worth knowing what is inside: which permissions it asks for, which components other apps can call, which certificate signed it and how large its parts are.
Open an APK here and this tool reads it entirely in your browser: package name and version, minimum and target SDK, requested permissions with the dangerous ones highlighted, exported components, signing certificates and an inventory of the archive.
How to use it
- Open an .apk file from your device.
- Check the package name, version and SDK levels.
- Review the permissions, starting with those marked dangerous.
- Look at exported components and the signing certificate, then use the inventory to see what takes up space.
Example: what counts as dangerous
Requested: ACCESS_FINE_LOCATION, INTERNET
ACCESS_FINE_LOCATION: dangerous INTERNET: normal
Android grants normal permissions such as INTERNET at install time. Dangerous permissions, which reach location, contacts, camera, microphone or files, must be granted by the user at runtime.
Reading the permissions
Android sorts permissions by protection level. Dangerous ones touch private data or sensors, and the tool flags the ones in that group. Ask whether each makes sense for what the app does: a flashlight app has no reason to read contacts or record audio. A long list of dangerous permissions in a simple app is a red flag for spyware or adware.
Exported components and signatures
Activities, services, receivers and providers marked as exported can be started by other apps. That is necessary for things like share targets, but an exported component without a permission guard is a common source of security bugs, so developers should check the list before each release.
Every APK is signed, and updates must be signed with the same key. Comparing the certificate fingerprint with the one the developer publishes confirms that a file really comes from them and was not repackaged.
Privacy and limits
The APK is unpacked and its binary manifest decoded in your browser; nothing is uploaded, so you can inspect internal builds safely. The tool reads the manifest and archive structure only. It does not decompile code or run the app, so it cannot prove an app is safe; for that, use a malware scanner or a full analysis tool such as MobSF.
Questions
Does it work with AAB or XAPK files?
It reads standard APK files. Android App Bundles (.aab) are a publishing format that Google Play turns into APKs, and XAPK is a ZIP of APKs; extract the base APK first.
What is the target SDK?
The Android version the app was built and tested for. Google Play requires recent target levels, and older targets can opt out of newer privacy protections.
Is the file uploaded?
No. Everything is read in your browser.