Drop an .apk. If raw res/values*/strings*.xml is still in the ZIP, preview and download it.
Most release builds compile strings into resources.arsc — then we export a UTF-8 / UTF-16LE scan. Not a full resource table decode.
No file selected
Upload an APK to begin.
Use it when you already have an APK and want a copy-review pass: leftover “DEBUG”, a typo in a button, or English still sitting in
values-de. Pair it with the APK analysis guide after the ZIP listing looks sane.
Do not use it as a localization suite. We do not reconstruct resource IDs, plurals, or string-array tables. We do not tell you which
density or locale a scan hit came from when the source is resources.arsc. For that, use apktool or aapt2 dump resources.
JSZip opens the APK. We list any path matching res/values*/strings*.xml (debug or unusual builds still ship these). For the common case we read
resources.arsc as bytes and extract printable UTF-8 and UTF-16LE runs of length ≥ 4. That is the same class of
heuristic as the APK Analyzer’s manifest scan — a string dump, not a parsed resource table.
Failure modes: release builds almost never contain raw XML. The scan will include class names, file paths, and library leftovers. Encrypted
or unusually packed resources will look empty. Binary XML that is not resources.arsc will not decode into a tree here.
Drop notes-release-24.apk. Expect “Raw strings XML: 0” and a scan of a few hundred lines. Search the TXT export for TODO,
localhost, or an old app name. If you instead see res/values/strings.xml in the list, you are looking at a debug-style package —
download that XML and treat it as source-adjacent, not as Play truth.
resources.arsc.APK analysis guide · APK Analyzer · Permissions Decoder
No. JSZip runs in this tab.
No. It is a printable-string heuristic. Use apktool when you need IDs and locales.
Release builds compile it into resources.arsc. That is expected.