An APK looks like a plain ZIP, but its identity is compiled into the AndroidManifest.xml and the signing block. Those hold the API keys baked into the app, every permission it requests, and the certificate that ties it to one developer key across every release. This scan decodes them in your browser - none of which a generic archive tool reads.
Scan a Android app fileAn APK is a ZIP, so a plain file listing tells you almost nothing. The value is in the compiled AndroidManifest.xml and the signing block, which this scan decodes. The manifest's <meta-data> is where developers stash API keys - a Google Maps AIza... key, an AdMob app id, a Firebase or Facebook identifier - and because they ship in the clear inside every copy of the app, anyone with the APK can extract and abuse them.
Every permission the app requests is listed, with the dangerous ones (location, camera, microphone, contacts, SMS, storage) flagged - this is the app's privacy-behaviour inventory. The signing certificate names the developer or organisation that published the build, and its SHA-256 fingerprint is the app's durable identity: Google Play, Firebase and API consoles register apps by exactly this value, so it ties this build to every other app signed with the same key.
The scan also reads the package name and version, the min, target and compile SDK levels that date the build, the components the app exports to other apps (its attack surface), and security red flags like a debuggable or test-only build that should never appear in a store release. The custom Application class and manifest metadata fingerprint the frameworks and SDKs inside - Flutter, React Native, analytics, ads, crash reporting - and the bundled native libraries reveal the CPU architectures and their build toolchain.
This is a selection. The full field manual documents the fields read from each format.
An APK's real metadata lives in its compiled AndroidManifest.xml and signing block, not its file listing. A scan surfaces the package name and version, every requested permission, API keys embedded in the manifest, the signing certificate and its SHA-256 fingerprint, the exported components, the SDK levels, and the frameworks and native libraries inside.
Yes. The scan reads the name, organisation and country on the APK signing certificate and computes its SHA-256 fingerprint. That fingerprint is the developer's durable identity - Google Play and Firebase register apps by it - so it links every app signed with the same key, though the name on it is self-asserted.
They can. Developers routinely place Google Maps, AdMob, Firebase or Facebook keys in the manifest's <meta-data>, and those ship in the clear inside every copy of the app. Anyone with the APK can extract them, which is why a raw key here is flagged as a high risk - quota theft, billing fraud, or backend impersonation.
The scan lists every permission the app requests and flags the dangerous ones (location, camera, microphone, contacts, SMS, call log, storage). Those are the user-facing privacy risk; the embedded keys and a debuggable or test-only flag are the developer's own exposure.
File X-Ray reads Android app files entirely in your browser - the file never leaves your device. This format is inspected, not modified. Scan a file now.