How do I run an adb shell command?

Switch on developer options and USB debugging on the phone, plug it in, then run adb shell from a machine with platform-tools installed — or run adb shell on its own to get an interactive prompt and type the command without the prefix. If the command produces binary output, such as a screenshot, use adb exec-out instead of adb shell: the plain shell service attaches a terminal, which rewrites newline bytes and corrupts the data.

Do adb shell commands need root?

Not the ones on this reference. They run as the shell user, which can manage packages for its own Android user, read most dumpsys services, write the settings provider, inject input and read shared storage. Root is only needed for things this reference deliberately avoids — reading another app's private data (except through run-as on a debuggable build), writing system partitions, or reading /data/anr directly.

Why does the output look different on my phone?

Either the Android version or the manufacturer. Some flags and fields arrived in a specific release, and those are noted per command. The rest is OEM patching, which hits dumpsys hardest: a dump is debug output whose text is whatever the service author last printed, and manufacturers change it and backport their changes. Read fields by name rather than by position, and treat an unfamiliar shape as a difference rather than as a failure.

Can I run this from a browser instead of a terminal?

For many commands, yes — the Web ADB tools on this site talk to a phone over WebUSB from a Chromium-based desktop browser, with no SDK installed and nothing uploaded. Each page links to the tool that runs its command, when one exists. Two limits are worth knowing: only one program can hold the ADB interface at a time, so a desktop adb server has to be stopped first, and adb forward and adb reverse cannot work in a browser at all.

pm path

read-only

Prints the absolute paths of the APK files that make up an installed package.

Command: adb shell pm path
Commands: Packages (pm)
Risk: read-only

Syntax

pm path [--user <id>] <package>

Flags and arguments

Token	Meaning
--user <id>	Ask about one Android user. Older builds reject the flag, in which case drop it and re-run.

Examples

```
pm path com.example
```
The base APK, plus one line per split on a split install.
```
pm path --user 0 com.example
```
The primary user's copy, rather than a work profile's.

Reading the output

Sample output

package:/data/app/~~kO7bJ9w==/com.example-Ay8s2Q==/base.apk
package:/data/app/~~kO7bJ9w==/com.example-Ay8s2Q==/split_config.arm64_v8a.apk

One `package:` line per file. A single line means a plain APK; several mean a split install, and pulling only the base one gives you an app that will not install anywhere. Not every line is an APK — the Play install also writes `.dm` dex-metadata sidecars, and those belong to the installer rather than to the app.

Output fields

Field	Meaning
package:<path>	One absolute device path per file of the package.
base.apk	The main APK.
split_*.apk	One configuration split: an ABI, a density or a language.
*.dm	Dex metadata written by the installer, not part of the app.

What access it needs

Nothing beyond an authorised `adb` connection: no root, no `adb root`, no `su`. `pm` is the one-line shell script `cmd package "$@"` (AOSP `cmds/pm/pm.sh`), so the question is answered with the identity of the `shell` user on the other end of the cable, and `path` only reads the package database — it installs, moves and deletes nothing. Two access facts do matter afterwards. First, `--user <id>` asks about somebody else's Android user, and a build unwilling to let the shell cross that boundary answers with a `SecurityException` instead of paths. Second, being told where an APK lives is not the same as being allowed to read it: whether `/data/app/**` is traversable for the shell user is not a documented guarantee, so a hardened build can print a perfectly good path that a later pull then refuses. `parsePmPathOutput` keeps refusals apart from an empty answer for exactly that reason, and the APK Extractor tool surfaces the difference rather than hiding it.

Failure messages, decoded

Message	Meaning
Error: Unknown option: --user	This build's `pm path` does not accept `--user`. Like every option refusal in this family it aborts before printing a single `package:` line, so the answer is missing rather than empty — drop the flag and ask again instead of concluding the app is not installed. Which release first accepted the flag here is not established in this repository, so treat the version as unknown and let the device answer.
Exception occurred while executing 'path':	The `ShellCommand` wrapper caught a `Throwable` and wrote this banner plus a stack trace to stderr. The line under it names the cause, and `java.lang.SecurityException` there means a user id the shell may not query. `findPmPathFailure` looks for this banner before reading any path, because a refused query and an uninstalled package are indistinguishable once stderr has been discarded.
cmd: Can't find service: package	`cmd` could not find the `package` service to hand the subcommand to. Expected while the device is still booting, before `system_server` has published it — wait for boot to finish rather than treating the phone as broken.

Version and vendor notes

An unknown package prints nothing at all and exits 1, so an empty result means "not installed" rather than "failed".
Whether the shell user can actually read `/data/app/**` is not a documented guarantee. On most builds the directories are traversable and the APKs readable, which is why pulling a base APK is a decade-old recipe, but hardened builds do refuse.

We have a UI for this

APK Extractor runs this command over USB and parses what comes back — a Chromium browser, no SDK, nothing uploaded.

Open APK Extractor

Related commands

Commands that turn up in the same session as pm path.

Command	What it does
pm list packages	Lists installed packages, optionally with the APK path, uid, version code and installer.
dumpsys package	Everything the package manager knows about one app: version, paths, flags, install source and per-user state.
pm install-create	Opens an install session so several APKs — a base plus its splits — are installed as one atomic unit.

More Packages (pm) commands

Command	What it does
pm uninstall	Removes a package, or removes it for one Android user only — which is how a preinstalled app is disposed of without root.
pm disable-user	Switches a package off for one Android user without removing it — the reversible alternative to uninstalling.
pm clear	Wipes an app's data — or, on Android 13 and later, only its cache.
pm trim-caches	Asks the system to drop cached files until the given amount of free space exists.
pm install	Installs one APK that is already on the device, which is what `adb install` does under the hood.

Checked against AOSP, toybox and kernel sources while writing the parsers behind our Web ADB tools. Where a behaviour genuinely varies by Android version or manufacturer, this page says so instead of giving a number that would be wrong on half the phones out there.