APK Inspector
See what an Android app file holds: its permissions, screens, the web addresses in its code and who signed it. Use a file you own or have the right to inspect. Free, with no sign up. Your file stays in this browser; nothing is uploaded.
Or drop it here.
Permissions
Components
Web addresses in the code
Signer
Files
| Path | Size | Packed |
|---|
What an APK inspector helps you check
- Which permissions your own build asks for, before you publish it.
- Which screens and services other apps can start.
- Which servers the code points to, and test addresses left in by mistake.
- Which key signed a build, so you can match it to your store listing.
Open only files you own or have the right to inspect.
Unzips with fflate (MIT).
How to use this tool
Pick an .apk file you own or have the right to inspect, or try the sample. Read its package, version and permissions, click a group in the chart to list only those, then look through components, web addresses, the signer and its files.
Frequently asked questions
Is my APK uploaded?
No. The page reads the ZIP directory at the end of the file, then unpacks only the manifest, the code files and the signature, one at a time, inside your browser. It makes no network call with your file.
What do the permission groups mean?
Each permission is sorted by what it reaches: location, camera and microphone, contacts and calendar, storage and media, network and nearby devices, phone and SMS, or other. "Asks first" marks the ones the phone asks the person about before the app gets them.
What does exported mean?
An exported screen, service, receiver or provider can be started by other apps. The launch screen has to be exported. Anything else that is exported should check who is calling it.
Where do the web addresses come from?
From the string table of each classes.dex file: the fixed text the app's code carries. Some are servers the app talks to; some are XML namespaces, library links or addresses it never uses. Addresses built while the app runs do not show up in full.
What does the signer certificate tell me?
Who signed the app and the dates the certificate is valid. Two versions of an app with the same SHA-256 fingerprint were signed with the same key. The page reads the certificate; it does not check the signature against the files.
Can it open an app bundle or a split APK?
Not directly. An .aab bundle stores its manifest in a different format, and .apks or .xapk files hold several APKs. Unzip those and open base.apk.
API Tool Calls MCP
Use it from an AI agent
This tool is also an MCP tool named inspect_apk at https://apitoolcalls.com/mcp.
Agent tools are free: 20 calls a day per IP, no key needed.
Example tools/call arguments:
{"name":"inspect_apk","arguments":{"file":"UEsDBBQAAAAIAAAAIVzqCJ9EVwEAAAwDAAATAAAAQW5kcm9pZE1hbmlmZXN0LnhtbG2STU4CQRCFXzPADD9GFixM5AQmzujOuJaFCWGhxj3RUQkKE0Dj0hN5AheexbV3wK+bHsCB7rzp6ldVr6q7J1CkZiAZdfRlpKbWo7dhW/4IXIBb8Am+wQ/4tQHktkEflDXWQC9KofdYh+yvda8RmammmsFM4KSG3v4x/VVeiDUmZwo/ZLXVnzRnZjpXwpzpDiYlfoAdF+JjvBN8CXxG5QRPSlyypRviHxA94vvoau/73Jjdu+so0zN27LQyIgKdsjvBilz9MVoPTn/uuFcsuzsG9tzS4VZ/mTu5vZ3Z6vyxLrmDG3V1xdrFst2s1XblSB8mUtt1ZUyzZEwHyLR0AFcCCwZPzLuwh++52CVvR4TdZpb8W1uuwlp1Z1FQzXPdbS250GudeV+uVfNaxmuVl7+GfJ2W7SnwvVUKebledYNv7NCzo+77qG/ohYW8nI8KZzWerxXu5g9QSwECFAAUAAAACAAAACFc6gifRFcBAAAMAwAAEwAAAAAAAAAAAAAAAAAAAAAAQW5kcm9pZE1hbmlmZXN0LnhtbFBLBQYAAAAAAQABAEEAAACIAQAAAAA="}}