What is inside this app?
Drop an Android APK, AAB or iPhone IPA to see its permissions in plain words, the advertising and analytics SDKs inside, who signed it, a malware scan of its files, and every file to download. Nothing is installed and nothing is uploaded.
How to check an app before installing it
- Drop the .apk, .aab, .xapk or .ipa file onto the box above.
- The analyzer opens the app in your browser and reads its manifest or Info.plist, code, signature and files. A malware scan of the files runs alongside.
- Read the warnings, permissions and SDK list, and download any file you want to look at more closely.
What it shows
Android apps (APK, AAB, XAPK, APKS)
- Name, icon, package and version, the oldest Android version it runs on and the version it targets.
- Permissions in plain words, grouped into special access (accessibility, device admin, drawing over apps, installing apps), sensitive permissions you approve, advertising permissions and the ones granted automatically.
- Risky settings: debug builds, unencrypted HTTP allowed, test builds, old target versions, apps packed to hide their code, and the combination of SMS access and an accessibility service that banking malware relies on.
- Components open to other apps, the web links and URL schemes the app opens, and the apps it looks for.
- Signing certificate with SHA-256 fingerprint, signature schemes (v1, v2, v3), and warnings for debug and public test keys.
- AndroidManifest.xml decoded from Android's binary format into readable XML, with resource names filled in.
iPhone and iPad apps (IPA)
- Name, icon, bundle ID and version, minimum iOS version, devices and architectures.
- Permission prompts with the app's own wording, including the request to track you across other apps.
- Provisioning profile: App Store, ad hoc, development or enterprise, the team, expiry date and number of devices.
- Code signature and entitlements, URL schemes, background modes, app extensions and bundled frameworks.
- App Store encryption, unsigned and ad-hoc signed apps, and switched-off App Transport Security.
- Info.plist as readable XML, and app icons converted from Apple's modified PNG format so they open anywhere.
SDKs and trackers
The analyzer looks for about 90 known SDKs in the app's code: advertising networks such as AdMob, AppLovin and Unity Ads; analytics such as Firebase, Mixpanel and Amplitude; install attribution such as AppsFlyer and Adjust; crash reporting such as Crashlytics and Sentry; and messaging, sign-in and payment SDKs. It also recognises apps built with Flutter, React Native, Unity, .NET MAUI, Cordova and other frameworks.
Malware scan
The app's code, native libraries and other files are scanned with the same open YARA rules as the Archive Virus Scanner. Each match links to VirusTotal; clicking sends only the file's fingerprint.
Getting files out of an app
APK and IPA files are ZIP archives. Every file inside is listed with a download button, and binary XML, property lists and Apple's PNGs can be downloaded in a readable form. In Chrome and Edge, Save all files to a folder writes the whole app to a folder you choose.
What it cannot tell you
The app is never installed or run, so what it does at runtime, which servers it talks to and what data it actually sends are not checked. SDKs hidden by heavy obfuscation or packing can be missed, and App Store apps have encrypted code. Signatures are read, not re-verified; Android and iOS check them when installing. A clean result is not a guarantee: only install apps from sources you trust.