Android APK Security Review: From Flags to Runtime Evidence
An Android APK security review should establish what actually shipped, then identify which observations need runtime or backend testing. A source-code.
APK & AAB analysis
APK Scan Report Generator
Run a full security pass on an APK: manifest flags, exposed secrets, privacy-sensitive APIs, third-party SDKs, plus a ClamAV and YARA scan, in one report.
APK Scan Report Generator is part of APKLint, an online toolkit for inspecting Android APK files. Run a full security pass on an APK: manifest flags, exposed secrets, privacy-sensitive APIs, third-party SDKs, plus a ClamAV and YARA scan, in one report. Upload an APK in your browser to view the relevant details; results reflect what the file itself exposes.
Drop your file here
or click to choose from your device
Accepts: .APK · up to 1 GB
Deleted after your scan. Files you upload are processed on our servers over an encrypted connection, then removed by the next hourly cleanup after analysis finishes (long scans are protected while they run). We never share them, and need no account.
About APK Scan Report Generator
Run a full security pass on an APK: manifest flags, exposed secrets, privacy-sensitive APIs, third-party SDKs, plus a ClamAV and YARA scan, in one report.
APK Scan Report Generator is part of APKLint’s apk & aab analysis toolkit — Unpack, inspect, and break down Android packages. It’s free to use and needs no account.
Your privacy is the default: files you upload are processed on our servers over an encrypted connection and permanently deleted by a scheduled hourly cleanup after analysis finishes, and never shared.
What APK Scan Report Generator checks
- Manifest security flags and exposed components
- Hard-coded secrets and privacy-API references
- Third-party SDK inventory
- A ClamAV + YARA pass, combined into one report
Good to know: An on-screen security report. It focuses on security indicators, not signing-certificate or size breakdowns (use the dedicated tools for those).
When to use APK Scan Report Generator
- Best for
- One combined security report over an APK when you want manifest flags, exposed secrets, privacy-sensitive APIs, and risk signals summarized together in a single document.
- Not the right tool for
- Not the tool for drilling into one narrow signal; the focused scanners are better when you already know what you are after.
- What you get back
- A report-style roll-up that merges several security checks into one summary you can read top to bottom.
- How it differs from related APKLint tools
- Where the Security Scanner and Vulnerability Scanner each emphasize one lens, this generates the combined report across lenses.
- Limitations
- A summary of static signals, not a guaranteed-complete audit or a runtime assessment.
How to use APK Scan Report Generator
- Choose your APK file — Drop an .apk file onto the page, or click to select it from your device.
- Send securely — The file is uploaded over an encrypted connection to our analysis servers.
- Read your report — APKLint unpacks and inspects the package and lays out the results on screen.
- Your file is removed — It's deleted by an hourly cleanup job after analysis finishes.
Why use APKLint
Always free
Every tool is free with no login and no paywall. Reasonable file and input limits keep the free service stable.
No on-page ad banners
A clean, focused interface with no third-party ad banners cluttering your results.
Privacy-first
Files you upload are deleted by a scheduled hourly cleanup after analysis finishes, and never shared.
Open-source engines
Combines androguard manifest/DEX analysis, YARA indicators, and a ClamAV signature scan.
No sign-up
Start immediately — no account, login, or email required.
Works anywhere
Runs in any modern browser, on desktop or mobile.
Frequently asked questions
What does APK Scan Report Generator do?
Run a full security pass on an APK: manifest flags, exposed secrets, privacy-sensitive APIs, third-party SDKs, plus a ClamAV and YARA scan, in one report.
What's in the report?
The security view of the APK in one place: manifest flags, secrets, privacy-API references, the SDK list, and a ClamAV/YARA scan.
Is it free to use?
Yes. Every tool on APKLint is completely free, with no sign-up and no account.
How is my data handled?
Your uploaded file and its result are processed on our servers over an encrypted connection, then removed by the next hourly cleanup after analysis finishes. We never share them.
What files can I send?
An Android APK — a .apk file — up to 1 GB.
Related tools
All product names, logos, and trademarks are property of their respective owners. APKLint is an independent toolset and is not affiliated with, endorsed by, or sponsored by Google, Android, or any other party.