ByteScope

APK Analyzer

Inspect an Android APK's manifest, permissions, signature, symbols and code — locally.

Your files never leave your browser — all processing is local.

Drop APK files here

or click to browse — .apk / .xapk / .apks / .apkm · analyzed locally, never uploaded

About this tool

This APK analyzer unpacks an Android .apk file and shows you what's inside: the package name and version, the full permission list with dangerous permissions flagged, every activity, service, receiver and provider (with exported components highlighted), the signing certificates behind the v1/v2/v3 signatures, and a breakdown of where the file's bytes go. It's built for developers checking their own builds, security-minded users vetting an APK before installing, and anyone curious what an app actually asks for.

It goes deeper than the manifest, too. The native libraries section lists every bundled .so, flags whether each one is stripped, and on demand parses the ELF symbol tables to show the C++ function names — the exported symbols from .dynsym and the full list from .symtab when present, demangled, with JNI (Java_…) entry points surfaced first. The code browser disassembles the DEX bytecode to Smali so you can browse every Java and Kotlin class and method, jump to definitions, and filter down to the app's own code.

Everything runs in your browser. The APK is a ZIP archive, so the tool reads its central directory, decompresses just the entries it needs, parses the binary AndroidManifest.xml and resources.arsc, extracts native symbols and DEX code, and computes certificate fingerprints with the Web Crypto API — all locally, with no upload. That makes it a fast way to check apk permissions, read native library symbols or verify an apk signature online without handing your file to a server.

Frequently asked questions

Is my APK uploaded to a server?
No. The APK is unzipped and parsed entirely in your browser using JavaScript and the Web Crypto API — the file never leaves your device. There is no upload step and no file-size limit beyond your machine's memory.
How does it read AndroidManifest.xml without decompiling the APK?
AndroidManifest.xml inside an APK is stored in Android's binary XML (AXML) format, not plain text. This tool includes a from-scratch AXML parser that reads the string pool and chunk structure directly, plus a resources.arsc parser to resolve the app's label and icon.
What do the dangerous and special permission flags mean?
Dangerous permissions (marked in magenta) are runtime permissions the user must explicitly grant — camera, location, contacts, SMS and so on. Special permissions (orange) are appop or signature-gated capabilities like drawing over other apps or installing packages. Normal permissions are granted automatically at install time.
Which signature schemes are supported?
v1 (JAR signing, from the META-INF PKCS#7 block), v2 and v3 (from the APK Signing Block). The tool shows which schemes are present and extracts the signing certificate's subject, issuer, validity dates and SHA-1 / SHA-256 fingerprints — useful for verifying an APK came from who you expect.
Does it support .xapk, .apks, .apkm and SAI bundles?
Yes. When you drop a .xapk, .apks, APKMirror .apkm or SAI export container, the tool finds the base (or universal) APK inside it and analyzes that, using the container's own metadata (manifest.json, toc.pb, info.json or meta.sai) to classify splits. Legacy encrypted .apkm files can't be read locally. Split configuration APKs are not merged in the MVP.
Why is the exported flag on some components highlighted?
A component marked android:exported="true" can be launched by other apps on the device, which is a common area to review for security. The tool flags exported activities, services, receivers and providers so you can spot them quickly.
Can it list the symbols and function names in an APK's native .so libraries?
Yes. For every native library (.so) the analyzer parses the ELF symbol tables in your browser: it detects whether the library is stripped, lists the exported functions from .dynsym and the full function list from .symtab when present, demangles C++ names, and surfaces JNI (Java_…) entry points first. A filter hides compiler- and STL-generated noise so the meaningful symbols stand out. Split bundles are covered too — symbols are aggregated across every APK inside a .xapk/.apks/.apkm.
Can I browse the Java and Kotlin classes and methods inside an APK?
Yes. The code browser disassembles the DEX bytecode to Smali entirely in your browser, so you can browse every Java and Kotlin class and method, jump to definitions, search, and filter to the app's own package instead of the framework and third-party libraries. It reads classes from the base APK of .xapk / .apks split bundles too.