View an APK online: metadata, binary XML, images, and verify

What the APK viewer shows

The APK Analyzer is the online viewer. You drop one APK. The script opens it with JSZip in the tab and prints:

• ZIP entry names, with a cut if the list is long
• A count of .dex files
• Whether any path matches lib/<abi>/*.so
• Whether AndroidManifest.xml is present
• SHA-256 of the whole file
• A heuristic for package, versionName, versionCode, and label, only when those strings appear as printable ASCII

That is the metadata this viewer can stand behind. The sample file notes-base.apk has whole-file SHA-256 df08881c47b751768eaf5bb11b836fcef8ccd13aaf665aff8b8a242a6e7c2d93. On that file the heuristic prints no package and no version, while aapt dump badging prints com.example.notes, versionCode 24003, and versionName 2.4.0. The screenshot and the badging line are on the analyzer page. The file is a sample built for the page, not a Play upload.

The page does not open an Android App Bundle as an app. If you drop an .aab, treat a missing manifest as “this container is not an APK,” then use bundletool on your machine. One split APK shows only the entries inside that split. Libraries in another split stay invisible until you drop that file too.

Android binary XML

AndroidManifest.xml inside an APK is Android binary XML, often called AXML. It is not text. The bytes are a compiled resource document. A text editor shows garbage. The Manifest Validator runs DOMParser on text, so pasting the raw entry fails with a parser error even when the APK is fine.

The analyzer’s heuristic does not decode AXML. It walks the manifest bytes looking for printable runs of at least four characters and keeps lines that look like package=, versionName, versionCode, or android:label. When the compiler stored those values in a string pool the scan cannot see, the block says no obvious package or version strings. A blank heuristic does not mean the package is missing.

To read the binary manifest, use one of these on a computer with the SDK:

• aapt dump badging your.apk for package, version codes, SDK levels, permissions, debuggable, and the launchable activity
• aapt dump xmltree your.apk AndroidManifest.xml for the element tree, including android:exported
• apktool, when you want a text AndroidManifest.xml in a folder

DroidXP does not run those programs. The job split is in browser tools versus apktool and aapt. If you have the Gradle project, the Merged Manifest tab is text you can paste into the validator. That text is still not the binary file inside the APK until you have built and dumped it. The merged manifest is not the XML you pasted walks through that gap.

Extract images from an APK

There is no image gallery on this site. The viewer tells you the entry names. It does not decode bitmaps and it does not offer a zip of pictures.

Loose image files are ordinary ZIP members. After you trust the file, unzip it locally and look in:

• res/drawable*, res/mipmap*, and density folders for PNG and WebP
• assets/ for pictures the app shipped outside the resource table

You will not get a complete icon set that way. Vector drawables are XML. Many resource references live in resources.arsc, which this site does not parse. Adaptive icons are an XML mask plus layers, not one PNG. The string extractor scans resources.arsc for text. It does not export drawables. The icon generator resizes a PNG you already have. It does not read an APK.

If the goal is “save the launcher bitmaps from this APK,” unzip, then open the mipmap PNGs or WebPs. If the goal is “every graphic the app can draw,” use Android Studio’s APK Analyzer or aapt, which understand the resource table. Renaming the APK to .zip is the same unzip. Do it on a machine you control. The file never needs to be uploaded here for that step.

Verify an APK online

People use “verify” for three different checks. This site does one of them.

Question	What answers it
Is this the same file CI built?	The analyzer’s SHA-256, or sha256sum / Get-FileHash on the same bytes. They should match.
Is the APK signed, and by which certificate?	apksigner verify --verbose and apksigner verify --print-certs. The analyzer does not run them. META-INF names in the file list only mean those entries exist.
Will Play accept this upload?	Play Console, comparing the upload certificate. A file hash will not explain a certificate rejection.

The signer guide prints the commands. apksigner order is align, then sign, then verify --verbose. jarsigner order is sign, then align, then verify. The page does not sign and does not add your password to the command. The certificate digest and the file hash are different strings. A file hash is not a signing certificate uses the sample numbers already published here. The sample certificate CN=Example is not a Play upload certificate.

A green hash and a failed apksigner verify can both be true. The file is intact and the signature block is not. Fix alignment and the keystore before you treat the hash as approval.

A short order when you only have the APK

1. Drop it on the APK Analyzer. Write down the SHA-256, the DEX count, the ABI folders, and whether the manifest entry exists.
2. If the heuristic package or version is blank, leave it blank. Run aapt dump badging before you fill a release note.
3. Unzip locally if you need the loose PNG and WebP files. Do not expect vectors or adaptive icons from that unzip.
4. Run apksigner verify --print-certs when the question is the signing certificate. Compare that fingerprint to the upload certificate in Play Console, not to the file hash.
5. Decode the binary manifest with aapt dump xmltree or apktool before you paste anything into the text validator.

The longer file pass is how to analyze an APK without installing it. This page is the map for the searches that ask for a viewer, binary XML, images, or an online verify step.