Security audit for your
mobile app

Drop an .apk or .ipa file and instantly inspect its manifest, permissions, signing certificate, embedded secrets and third-party SDKs — everything runs locally in your browser.

Audit Your App

Analyze your app package

Choose a release .apk or .ipa. The file is parsed on your device — nothing is uploaded anywhere.

Drop your .apk or .ipa here

or click to browse your files

APK & IPA · up to 500 MB · analyzed entirely in your browser

Analyzing your app…

Reading file…

A solid mobile security habit

Five steps to ship a safer app.

  1. 1Grab your release build — audit the actual .apk or .ipa you plan to ship. Debug builds are signed with a debug key and show different flags.
  2. 2Start with Critical and High findings — embedded API keys, debuggable builds and cleartext traffic are the fastest wins.
  3. 3Trim permissions — ask for the least privilege. Every permission you remove shrinks your attack surface and App Store review friction.
  4. 4Keep transport strict — enforce HTTPS, keep App Transport Security exceptions to a minimum, and rotate any key you find embedded.
  5. 5Re-run before every release — SDK updates and new team members quietly introduce permissions and secrets. Make the audit part of CI.

Common questions

Everything you need to know about this app auditor.

Is my app uploaded anywhere?

No. Every parser runs locally in your browser — the ZIP reader, the manifest and DEX parsers, the certificate decoder. Your file never leaves this tab.

Which files does it accept?

.apk for Android and .ipa for iOS, up to 500 MB. It does not accept .aab, .xcodeproj or .xcarchive files.

Why is my app flagged as signed with a debug key?

If the signing certificate subject or issuer contains "Android Debug", the app was signed with the default debug keystore (e.g. debug.keystore). Sign with your production keystore before shipping.

What do the severity levels mean?

Critical — exposed credentials or private keys that can be used directly. High — serious misconfiguration (debuggable, cleartext, weak signing). Medium — meaningful hardening gaps. Low — best-practice issues. Info — factual observations such as embedded SDKs.

Why does my app have so many "tracker" results?

Third-party SDKs (analytics, ads, crash reporting) are common and often legitimate. The auditor lists them so you can review them against your privacy policy. They are reported as informational.

What if the analysis fails?

Make sure the file is a valid .apk or .ipa and not renamed from another format. Corrupted downloads or 7-Zip repacked files can also fail. Check the error message for details.