What the Android tools on DroidXP send off your computer

The distinction that matters

A tool can be local and a page can still load scripts. On DroidXP the Android tools read files with the browser File API and parse them in JavaScript. The site has no upload endpoint for those tools, and the scripts do not fetch the file to a DroidXP server. Separate from that, the HTML page loads libraries and fonts from other hosts. Those requests do not include the APK. They do include the ordinary browser request for a script or an image, which carries an IP address and the page URL the way any HTTPS request does.

If your rule is that a production binary never opens in a normal browser, follow that rule and use aapt and apksigner on a machine that meets it. The table below is for people who are allowed to open the file in a browser and want to know what the page loads.

Tool by tool

Page	What it reads	Where that data goes
APK Analyzer	The dropped file as an ArrayBuffer. JSZip lists entries. Web Crypto hashes the buffer.	The tab. The JSZip script itself is loaded from cdn.jsdelivr.net when the page loads, before you drop a file. The file is not sent to jsDelivr.
String extractor	The same kind of ZIP read. It looks for raw res/values*/strings*.xml and scans resources.arsc bytes.	The tab. Downloads (txt, json, zip) are generated locally and saved by the browser.
Manifest validator	Text you paste or a text file you pick. DOMParser reads it.	The tab. Binary XML fails the parse. It is not uploaded for someone else to decode.
Permissions decoder	Text you paste, matched against a list compiled into the script.	The tab. The list is not fetched from Google.
ADB generator	Form fields. It concatenates a command string.	The tab, and your clipboard if you copy. It does not open adb or a device socket.
Intent URL generator	Form fields. It builds an intent:// string and a plain URL.	The tab. It does not request the host you typed.
Deep-link tester	URLs you paste. URL parsing plus an adb line.	The tab. It does not fetch assetlinks.json or the page behind the URL.
Version checker	Your search string, compared with a table from API 16 through API 36 that ships in the script.	The tab. It is not a user-agent lookup and it does not identify your phone.
Icon generator	The image you drop, drawn to canvases. Output PNGs are zipped in the tab. JSZip is used for the zip download.	The tab. The image is not posted to an optimizer.
APK signer guide	Filenames, alias, algorithm, and sizes you type.	The tab, as command text. There is no keystore field that reads a key file. Do not paste a password into the distinguished-name field. The page would treat it as text in the command, and copying that command into a ticket would leak it. The script does not add a password flag.

What every page loads besides the tool

The shared layout loads Bootstrap and Bootstrap Icons from jsDelivr, and font CSS from Google Fonts. Those requests happen when you open the page, whether or not you drop a file. The tool scripts under /assets/js/ are loaded from droidxp.com, which is this site. That request does not contain your APK.

This site does not load a Google Analytics tag. Do not type secrets into a field and assume the page is the only thing that can see them: a browser extension can read the page, and a crash report attached to a screenshot can contain the field.

Advertising is not loaded. Empty advertisement placeholders in the HTML do not request an ad server. The privacy policy is the visitor-facing statement of the same facts.

After a drop on the APK Analyzer, the network panel should show no POST of the file. The requests that leave the machine are the ones named above: this site’s scripts, jsDelivr, and Google Fonts. This page does not include a panel capture.

What “in the tab” does not protect you from

• The device you are using. Malware, a shared login, or a shoulder looking at a permission list defeats local processing. Lock the screen. Do not analyze a build you are not allowed to hold on that computer.
• Extensions. An extension can read the DOM, including a pasted manifest and a command line. Use a browser profile without extra extensions when the file is sensitive.
• Downloads. The string extractor and the icon generator write files into your downloads folder. Those files are copies. Delete them if the source was confidential.
• Clipboard. Copy buttons put the report or the command on the clipboard. Other apps can read it. A command that you edited to include a password is now on the clipboard.
• CDN availability. If jsDelivr is blocked, the analyzer cannot list the ZIP, because JSZip is not bundled into the page. That failure is a missing script, not a silent upload.
• Logs you paste elsewhere. A SHA-256 is not secret in the way a keystore is, but a full path in an adb command can contain a username. Read the line before you put it in a ticket.

Accounts and retention

The Android tools do not ask you to create an account, and they do not write the dropped file into the site’s storage. There is no DroidXP database row for your APK, because the server never received it. The server can still keep ordinary web-server logs of the GET request for the HTML and the scripts, which include IP address and user agent. Those logs are a hosting concern, not a copy of the binary.

Questions about a visit, or about this description, go to thedroidxapps@gmail.com.

A practical rule

Use these tools for inspection of builds you are allowed to open on a normal workstation. Use SDK tools on an offline or managed machine when the binary is production signing material or when policy says the file cannot sit in a browser process. Prefer the signer guide’s printed commands over typing a keystore password into any web form, including this one. The form does not want the password. The terminal prompt from keytool and apksigner does.

The job table tells you when to leave the browser for accuracy. This page tells you when to leave the browser because of where the bytes are allowed to be. Both can apply to the same file. When they do, the stricter rule wins: if policy forbids the browser, do not open the analyzer “just for the hash.” Hash the file with a local command on the machine that is allowed to hold it.