Does the APK get uploaded to a server?

No. The file is read with the browser File API and parsed in memory, so it never leaves the device and no copy is kept.

How does it read permissions from a compiled manifest?

A built manifest is binary XML. The analyzer reads its string pool, which holds the permission names as literals, rather than fully parsing the resource table.

Is the permission list complete?

No. Permissions granted from code at runtime, or referenced through a resource instead of a literal, will not appear. Treat the list as a first pass, not a full audit.

Is reading an APK here safe?

Nothing is executed or installed. The file is only unpacked in memory to read its structure.

APK Analyzer

Read an APK in your browser and list its permissions, SDK levels, and activities.

Loading tool…

APK Analyzer on Loonix helps you read an APK in your browser and see the permissions it declares, the SDK levels it targets, and the native libraries it ships. Nothing is uploaded.

How to use

Choose the APK file from your device or file manager.
Wait for the browser to unpack it in memory.
Read the permissions list, then check anything surprising against the app description.

Features and limitations

Reads the APK with the browser File API, so nothing is uploaded and no copy is stored.
Lists the permissions declared in the manifest and flags which ones need a runtime prompt.
Reports native libraries per architecture, DEX file count, and whether the archive carries signature files.
Reads the AXML string pool rather than fully parsing resources, so runtime-granted permissions do not appear.

Limitation: Reads the AXML string pool rather than fully parsing resource tables, so permissions granted at runtime or referenced through a resource will not appear, and the package name and version are not extracted.

Use cases

Check what an APK asks for before installing it from outside the Play Store.
Compare the permission list of an app update against the previous release.
Look at which CPU architectures an app ships native libraries for.

Frequently asked questions

Usage, result, and limitation information for this tool.

Does the APK get uploaded to a server?: No. The file is read with the browser File API and parsed in memory, so it never leaves the device and no copy is kept.
How does it read permissions from a compiled manifest?: A built manifest is binary XML. The analyzer reads its string pool, which holds the permission names as literals, rather than fully parsing the resource table.
Is the permission list complete?: No. Permissions granted from code at runtime, or referenced through a resource instead of a literal, will not appear. Treat the list as a first pass, not a full audit.
Is reading an APK here safe?: Nothing is executed or installed. The file is only unpacked in memory to read its structure.