# APKLint

Content revision: 2026-09-22
Generated at: 2026-09-22T00:00:00Z

> An online toolkit for inspecting and analysing Android APK files in the browser.

## Primary purpose

Users upload an APK and the site surfaces details the file exposes; the static frontend talks to an analysis backend.

## Important sections

* [Home](https://apklint.com/)
* [About | APKLint](https://apklint.com/about)
* [Contact | APKLint](https://apklint.com/contact)
* [AAB Analyzer — Free Android Tool | APKLint](https://apklint.com/aab-analyzer/)
* [Android Accessibility Checker — Free Android Tool | APKLint](https://apklint.com/accessibility-scanner-android/)
* [Ad SDK / Tracker Detector — Free Android Tool | APKLint](https://apklint.com/ad-sdk-tracker-detector/)
* [AdMob Policy Checker — Free Android Tool | APKLint](https://apklint.com/admob-advertising-id/)
* [Android App Analyzer — Free Android Tool | APKLint](https://apklint.com/android-app-checker/)
* [Android Performance Checker — Free Android Tool | APKLint](https://apklint.com/android-app-performance-analyzer/)
* [Android App Scanner — Free Android Tool | APKLint](https://apklint.com/android-app-scanner/)
* [Cleartext Traffic Checker — Free Android Tool | APKLint](https://apklint.com/android-cleartext-traffic-checker/)

## Key page groups

* Tool (61): browser-based tools, one task each (includes policy/privacy helper tools such as the Privacy Policy Generator, Kids App Policy Checker, Privacy-Sensitive API Checker, and Game Privacy Policy Checklist).
* Legal (4): the site's own privacy, terms, cookies, and disclaimer pages.
* About (1): background information.
* Contact (1): contact details.
* Home (1): site entry point.

## Machine-readable files

* [Full LLM index](https://apklint.com/llms-full.txt)
* [LLM sitemap](https://apklint.com/llms-sitemap.xml)
* [XML sitemap](https://apklint.com/sitemap.xml)

## Notes for AI assistants

All content is factual and specific to APKLint; pages are static and figures come from the pages themselves. This llms.txt is an optional readability aid and is not required by any search engine. APKLint is a static frontend for Android APK analysis; the analysis backend is a separate service. Each tool page covers a specific check, and results reflect what an uploaded file itself exposes.


## Android engineering blog

262 original Global-English guides, authored by APKLint. These are reference articles, not additional APK-analysis tools. There are still 61 tool pages. Article review date: 2026-09-22. Individual commands are illustrative; no private Console or user artifact is verified by reading a guide.

* [Blog archive](https://apklint.com/blog/)
* [Blog sitemap](https://apklint.com/blog/sitemap.xml)
* [Published article index](https://apklint.com/assets/blog/blog-index.8ebeca6fdd24.json)

### APK & App Bundles

* [APK File Structure: What Each Folder Actually Contains](https://apklint.com/blog/apk-file-structure/): An APK is an installable Android package, not a folder of editable project source. Its ZIP container holds compiled code, compiled resources, a manifest.
* [Analyze an APK in Android Studio Without Misreading the Results](https://apklint.com/blog/android-studio-analyze-apk/): Android Studio's APK Analyzer is most useful when you have a specific question: which dependency grew, why a native architecture is missing, or which.
* [Check an APK File: Identity, Integrity and Risk Are Different Questions](https://apklint.com/blog/check-apk-file/): To check an APK file properly, separate three questions: what package is this, has its signed content been modified, and does its behavior create.
* [Read APK Information: Package Name, Version and SDK Levels](https://apklint.com/blog/apk-info-package-version/): APK information is most reliable when read from the built package. The download filename, store title and Java source namespace can all differ from the.
* [APK Size vs Download Size vs Installed Size](https://apklint.com/blog/apk-download-installed-size/): An APK's file size, estimated download size and installed storage use are different measurements. Before optimizing, decide which one affects the user.
* [Reduce APK Size by Measuring the Largest Contributors First](https://apklint.com/blog/reduce-apk-size/): Reduce APK size by finding the largest avoidable contributor in a release build. Blindly enabling every shrinking flag, recompressing the final APK or.
* [Why an APK Size Reducer Cannot Safely Replace a Release Build](https://apklint.com/blog/apk-size-reducer-limits/): An APK size reducer should not be treated like an image compressor. APK entries participate in an installable, signed package with alignment and runtime.
* [Can You Recover an Android Studio Project from an APK?](https://apklint.com/blog/apk-to-source-code-limits/): Decompiling an APK can recover useful representations of compiled code and resources, but it usually cannot restore the original Android Studio project..
* [Decode an APK: Archive Extraction vs Resource Decoding](https://apklint.com/blog/decode-apk-resources/): Decoding an APK is different from unzipping it. Unzipping exposes stored entries; decoding interprets Android's compiled manifest and resource table..
* [Extract Images from an APK Without Losing Resource Context](https://apklint.com/blog/extract-images-from-apk/): Extracting images from an APK starts with understanding Android resources. Some visible graphics are PNG or WebP files, but others are vectors,.
* [Extract Files from an APK Safely and Keep an Inventory](https://apklint.com/blog/extract-files-from-apk/): You can extract files from an APK without installing it, but the safest workflow begins with a bounded inventory. Copy only the entries you need, preserve.
* [Extract an Installed APK with ADB, Including Split Packages](https://apklint.com/blog/extract-installed-apk-adb/): To extract an installed Android application, ask the package manager for its actual APK paths. Do not assume there is only one base.apk: modern Play.
* [Choose an APK Extractor: Split Support, Provenance and Privacy](https://apklint.com/blog/choose-apk-extractor/): The best APK extractor for a particular job is the one that preserves the package set and its provenance without introducing unnecessary access or privacy.
* [Extract XAPK to APK: Why the Base APK May Not Be Enough](https://apklint.com/blog/extract-xapk-to-apk/): An XAPK is a distribution container, not an Android platform installation format like a standalone APK. Its contents can include a base APK, configuration.
* [Extract APKs from an AAB with bundletool](https://apklint.com/blog/extract-apk-from-aab/): Use bundletool to generate APKs from an Android App Bundle. An AAB is not an APK with a different extension, and its module manifests and resource.
* [AAB vs APK: Publishing Format, Install Format and Testing](https://apklint.com/blog/aab-vs-apk/): An APK is a package Android can install. An Android App Bundle is a publishing artifact from which a distribution service or bundletool generates APKs.
* [Inside an Android App Bundle: Modules, Manifests and Configuration](https://apklint.com/blog/android-app-bundle-structure/): An Android App Bundle organizes an application into modules rather than presenting the final device installation as one flat APK. Understanding the base.
* [Install Split APKs Without Missing a Required Split](https://apklint.com/blog/install-split-apks/): Split APKs must be installed as a coherent package set. Installing only the base file, or mixing splits from different versions, can produce missing-split,.
* [Use a bundletool Device Specification for Reproducible Tests](https://apklint.com/blog/bundletool-device-spec/): A bundletool device specification makes an APK-generation test reproducible. It records device characteristics used to select appropriate packages from an.
* [Check APK Architecture: arm64-v8a, armeabi-v7a and x86_64](https://apklint.com/blog/apk-abi-architecture/): Check an APK's native architecture by inspecting its packaged lib/<abi>/ directories, not by guessing from the phone model or the APK filename. The.
* [Check Android 16 KB Page-Size Compatibility in Native Libraries](https://apklint.com/blog/android-16kb-page-size/): Android 16 KB page-size compatibility is a native-binary and packaging question, not something solved by raising targetSdk alone. Apps that include native.
* [What Is classes.dex? Reading an Android DEX Inventory](https://apklint.com/blog/android-dex-file/): classes.dex contains compiled code for Android's runtime. An APK can include several DEX files, and their class inventory includes application code,.
* [Read Smali Code: Registers, Methods and Control Flow](https://apklint.com/blog/smali-code-tutorial/): Smali is a human-readable representation of Android DEX instructions. To read it usefully, track a method's inputs, registers, calls and branches. Treat.
* [Use JADX for Android Analysis Without Assuming Perfect Source Recovery](https://apklint.com/blog/jadx-for-android/): JADX is useful for understanding managed code and resources in an Android APK, but its output is a reconstruction. A method that looks like ordinary Java.
* [Decompile and Recompile an APK: A Controlled Lab Workflow](https://apklint.com/blog/decompile-recompile-apk/): Decompiling and recompiling an APK is a laboratory workflow, not a way to preserve the original release automatically. Decoding can be imperfect,.
* [Android Multidex: When You Need It and When You Do Not](https://apklint.com/blog/android-multidex/): Android multidex addresses the method-reference limit of a single DEX file. It is not a general performance optimization and should not be enabled as a.
* [MultiDexApplication vs MultiDex.install: Fixing Startup on Older Android](https://apklint.com/blog/multidexapplication-setup/): MultiDexApplication and MultiDex.install() solve the same legacy startup problem through different integration points. Choose the pattern that fits your.
* [versionCode vs versionName: Preventing Play Upload and Update Errors](https://apklint.com/blog/android-version-code-name/): versionCode controls Android release ordering; versionName is a display label. Confusing them leads to reused Play version codes, blocked upgrades and.

### Signing & App Identity

* [App Bundle Signed with the Wrong Key: Diagnose Before Resetting](https://apklint.com/blog/wrong-app-bundle-signing-key/): When Play Console says your Android App Bundle is signed with the wrong key, compare the expected upload certificate with the certificate used by the.
* [Generate a Signed APK in Android Studio and Verify the Output](https://apklint.com/blog/generate-signed-apk-android-studio/): Generating a signed APK requires choosing the correct application module, release variant and signing identity. A file called app-release.apk is not enough.
* [Android Debug Keystore Password: Defaults and Safe Use](https://apklint.com/blog/android-debug-keystore-password/): The standard Android debug keystore uses the password android, the key password android and the alias androiddebugkey. These public defaults are for.
* [Find Your Android Signing Keystore Without Generating the Wrong Key](https://apklint.com/blog/find-android-keystore/): There is no universal folder for an Android release keystore. The correct file is the one referenced by your authorized release configuration and.
* [Create an Android Signing Keystore with a Recovery Plan](https://apklint.com/blog/create-android-signing-keystore/): Create an Android signing keystore only after deciding whether it will be an upload key or the actual app-signing identity. The technical generation step.
* [Android Keystore Password vs Key Password vs Alias](https://apklint.com/blog/android-keystore-passwords/): An Android signing setup can involve a keystore password, a key-entry password and an alias. These values are related but not interchangeable. The alias.
* [Play App Signing: App-Signing Keys, Upload Keys and Certificates](https://apklint.com/blog/play-app-signing/): Play App Signing separates the key used to upload a release from the key used to sign APKs delivered to users. That separation improves operational.
* [Verify an APK Signature with apksigner, Not Just a Certificate Viewer](https://apklint.com/blog/verify-apk-signature/): To verify an APK signature, use a tool that validates the signed package, such as Android's apksigner. Reading a certificate or detecting a v2 signing.
* [Find SHA-1 and SHA-256 Fingerprints for the Correct Android Build](https://apklint.com/blog/certificate-fingerprints-sha1-sha256/): An Android certificate fingerprint identifies a signing certificate using a hash algorithm. SHA-1 and SHA-256 fingerprints of the same certificate look.
* [APK Signing Schemes v1, v2, v3 and v4: What Each Adds](https://apklint.com/blog/apk-signature-schemes/): APK signing schemes describe how Android verifies package integrity and signing identity. They are not a simple “higher number means this app is safe”.
* [Reset a Lost Google Play Upload Key Without Replacing App Identity](https://apklint.com/blog/reset-play-upload-key/): A lost Google Play upload key can often be reset through Play App Signing without changing the app-signing identity delivered to users. The reset is an.
* [Android Signing-Key Rotation: Plan Compatibility Before Upgrading](https://apklint.com/blog/android-signing-key-rotation/): Signing-key rotation is a planned identity transition, not simply replacing a keystore file. Android and Google Play provide mechanisms that can preserve.
* [Keep Android Signing Credentials Out of Gradle Repositories](https://apklint.com/blog/signing-config-ci/): Android release signing in CI should provide the build with the minimum credentials it needs without placing private keys or passwords in the repository..
* [Android Keystore API vs a Signing Keystore: Two Different Systems](https://apklint.com/blog/android-keystore-api/): Android Keystore API and an Android signing keystore are different systems. The runtime Keystore protects cryptographic keys used by an installed app. A.
* [Store Secrets with Android Keystore: Encrypt Data, Do Not Store Passwords as Keys](https://apklint.com/blog/store-secrets-android-keystore/): Android Keystore stores cryptographic keys, not arbitrary passwords as a general-purpose database. A common design is to generate a Keystore-protected key.
* [Hardware-Backed Keystore: Verify Support Instead of Assuming It](https://apklint.com/blog/hardware-backed-keystore/): A key generated through Android Keystore is not automatically guaranteed to be protected by the strongest hardware available on every device. Check the.
* [Configure a React Native Android Release Keystore Correctly](https://apklint.com/blog/react-native-signing-keystore/): A React Native Android release uses Android's signing system. JavaScript tooling does not remove the need for a stable upload credential, a correct release.
* [Fix INSTALL_FAILED_UPDATE_INCOMPATIBLE Without Losing User Data Blindly](https://apklint.com/blog/install-failed-update-incompatible/): INSTALL_FAILED_UPDATE_INCOMPATIBLE commonly indicates that the incoming package cannot update the installed app under its current identity, often because.
* [zipalign Before Signing: Verify Alignment Without Invalidating an APK](https://apklint.com/blog/zipalign-before-signing/): Run zipalign before the final apksigner step. Alignment changes the APK's bytes; changing protected content after modern APK signing can invalidate the.
* [Package Name vs applicationId: Which Identity Does Google Play Use?](https://apklint.com/blog/android-package-application-id/): An Android application's applicationId is its installed and Google Play identity. The code namespace organizes generated and source references. They often.

### Security & Reverse Engineering

* [Certificate Pinning on Android: Benefits, Failure Modes and Rotation](https://apklint.com/blog/android-certificate-pinning/): Certificate pinning restricts which certificate public keys an Android client accepts for a server. It is not a substitute for TLS, hostname validation or.
* [usesCleartextTraffic=true: Scope the Exception, Do Not Disable Security Globally](https://apklint.com/blog/usescleartexttraffic-true/): android:usesCleartextTraffic="true" permits cleartext traffic in participating Android network components; it does not encrypt HTTP or make an insecure.
* [Build an Android Network Security Configuration with Narrow Trust Rules](https://apklint.com/blog/network-security-config/): An Android Network Security Configuration defines app-specific trust and cleartext policies declaratively. A useful configuration is small enough to.
* [Check an APK for Malware Without Treating Zero Detections as Proof](https://apklint.com/blog/check-apk-for-malware/): Checking an APK for malware is a risk assessment, not a single green badge. A clean result means the checks performed did not identify a problem at that.
* [VirusTotal APK Checks: Read Detections and Protect Confidential Builds](https://apklint.com/blog/virustotal-apk-check/): A VirusTotal APK report aggregates security signals from multiple providers. Its detection count is a starting point for investigation, not a probability.
* [APK Malware Analysis: A Static Triage Worksheet](https://apklint.com/blog/apk-malware-analysis/): Static APK malware analysis examines a package without executing it. The goal of an initial triage is to produce testable observations: suspicious.
* [Android Static Analysis: What the Binary Can and Cannot Tell You](https://apklint.com/blog/android-static-analysis/): Android static analysis covers several different activities: checking source code, inspecting a compiled APK and reviewing dependency metadata. Choosing.
* [Evaluate Mobile Security Testing Services with a Verifiable Scope](https://apklint.com/blog/mobile-security-testing-services/): The most useful question when evaluating mobile security testing services is not “how many vulnerabilities will you find?” It is “what evidence will you.
* [Scope an Android Penetration Test Before Testing Any Endpoint](https://apklint.com/blog/android-penetration-testing-scope/): An Android penetration test needs a written scope before anyone probes an app or its backend. The APK is only one part of the system: accounts, APIs, SDK.
* [Mobile App Security Checklist: Evidence for Each Control](https://apklint.com/blog/mobile-security-checklist/): A mobile app security checklist is useful only when each item has evidence and an owner. “Encryption enabled” is too vague to close a review; naming the.
* [Use the OWASP MASTG for an Android Test Plan](https://apklint.com/blog/owasp-mastg-android/): The OWASP Mobile Application Security Testing Guide, or MASTG, is a testing resource—not a one-click compliance scanner. For an Android app, use it to turn.
* [OWASP Mobile Top 10: Turn Risk Categories into Android Checks](https://apklint.com/blog/owasp-mobile-top-10/): The OWASP Mobile Top 10 is a risk-awareness resource. It helps teams discuss recurring classes of mobile security problems, but it is not a complete.
* [OWASP Mobile Top 10 2016: Historical Mapping, Not Current Guidance](https://apklint.com/blog/owasp-mobile-top-10-2016/): The OWASP Mobile Top 10 2016 remains useful for understanding older reports, but it should not be presented as the current checklist for a new Android.
* [MASVS vs MASTG vs Mobile Top 10: Pick the Right OWASP Resource](https://apklint.com/blog/owasp-masvs-vs-mastg/): MASVS, MASTG and the Mobile Top 10 answer different questions. MASVS helps define expected controls, MASTG helps test them, and the Mobile Top 10 helps.
* [Android APK Security Review: From Build Flags to Runtime Evidence](https://apklint.com/blog/android-apk-security-review/): An Android APK security review should establish what actually shipped, then identify which observations need runtime or backend testing. A source-code.
* [Reverse Engineer an APK You Own: A Reproducible Analysis Notebook](https://apklint.com/blog/reverse-engineer-owned-apk/): Reverse engineering an APK you own is most productive when it starts with a narrow question: which dependency shipped, why a resource is missing, or what.
* [Mobile App Reverse Engineering: Authorization, Evidence and Limits](https://apklint.com/blog/mobile-reverse-engineering-limits/): Mobile app reverse engineering can reveal implementation details in a distributed client, but it cannot recover everything that produced that client..
* [“Decrypt APK File” Usually Means Decode: Identify the Actual Format](https://apklint.com/blog/decrypt-apk-file/): “Decrypt APK file” often describes the wrong operation. A normal APK is a ZIP-based package containing compiled code and resources. Opening the archive,.
* [Hardcoded API Keys in APKs: Separate Public Identifiers from Secrets](https://apklint.com/blog/hardcoded-api-keys/): A string that looks like an API key is not automatically a confidential secret. The important questions are what the credential authorizes, whether it is.
* [Audit Exported Android Components Without Breaking Intended Entry Points](https://apklint.com/blog/android-exported-component-security/): An exported Android component is reachable from outside the app under the applicable platform rules. Exporting is sometimes necessary, but it should be a.
* [Android WebView Security: Validate Origins, URLs and JavaScript Bridges](https://apklint.com/blog/android-webview-security/): A secure Android WebView starts with a narrow trust model: which content may load, which origins may interact with native code, and which navigation leaves.
* [Android Backup Rules: Keep Sensitive Data Out of Backups](https://apklint.com/blog/android-backup-sensitive-data/): Android backup rules determine which app data can leave its normal on-device storage context through supported backup and transfer mechanisms. Excluding a.
* [Audit Third-Party SDKs and Trackers Beyond Library Name Detection](https://apklint.com/blog/android-sdk-tracker-audit/): An SDK or tracker audit needs more than a list of library names. Identify the versions that ship, the features enabled, the data actually collected and the.

### Manifest & Permissions

* [Android Dangerous Permissions: Build a Version-Aware Inventory](https://apklint.com/blog/android-dangerous-permissions/): Android “dangerous” permissions protect access to sensitive data or capabilities and can require a runtime grant. The label does not mean an app is.
* [Android INTERNET Permission: Manifest Placement and Connection Failures](https://apklint.com/blog/android-internet-permission/): The Android INTERNET permission belongs directly inside <manifest>, not inside <application>. It allows network access under platform rules and does not.
* [uses-permission vs permission: Declaring Access vs Defining a Capability](https://apklint.com/blog/uses-permission-vs-permission/): <uses-permission> requests access to an existing permission. <permission> defines a permission that your app can use to protect its own exposed.
* [Android Runtime Permission Example with Denial and Retry Handling](https://apklint.com/blog/runtime-permission-example/): A runtime permission flow needs three outcomes: already granted, newly granted and denied. It also needs a useful fallback. Showing a permission dialog.
* [Check an Android Permission at the Point of Use](https://apklint.com/blog/check-android-permission/): Check an Android permission immediately before the operation that needs it. A manifest declaration describes intended access; a stored boolean describes.
* [Inspect App Permissions: Manifest Declarations vs Current Grants](https://apklint.com/blog/inspect-app-permissions/): To inspect app permissions, distinguish three things: permissions declared in the APK, permissions currently granted on a device, and operations the app.
* [Build a Mobile App Permissions Audit That Includes SDK Additions](https://apklint.com/blog/mobile-app-permissions-audit/): A mobile app permissions audit should connect every requested capability to a current feature and a release owner. Counting permissions is not enough: one.
* [Android Overlay Permission: Settings Flow and Safe Failure Handling](https://apklint.com/blog/android-overlay-permission/): Drawing over other apps uses special access, not an ordinary runtime permission dialog. Declare the capability only when the feature genuinely needs an.
* [READ_PHONE_STATE: What It Allows and What It Does Not](https://apklint.com/blog/read-phone-state-permission/): READ_PHONE_STATE grants access to particular telephony information under Android's current rules. It is not a universal permission to obtain a phone.
* [Android Phone Permissions: Separate Calls, State and Call Logs](https://apklint.com/blog/android-phone-permissions/): Android phone permissions are not one interchangeable group. Reading phone state, placing a call and accessing call logs have different purposes and.
* [USE_FULL_SCREEN_INTENT: Check Eligibility Before Requesting Access](https://apklint.com/blog/full-screen-intent-permission/): USE_FULL_SCREEN_INTENT is for genuinely urgent experiences such as incoming calls and user-configured alarms. It is not a general method for forcing an.
* [Android Background Work Has No Universal “Run in Background” Permission](https://apklint.com/blog/android-background-work-permission/): Android has no universal “run in background” permission that makes arbitrary work run forever. The correct implementation depends on what the work does,.
* [Android Autostart Permission: OEM Settings Are Not a Portable API](https://apklint.com/blog/android-autostart-permission/): “Autostart permission” usually refers to a manufacturer-specific device setting, not one portable Android permission that every app can request. Treat it.
* [WRITE_SECURE_SETTINGS: Why Ordinary Apps Cannot Request It Normally](https://apklint.com/blog/write-secure-settings-permission/): WRITE_SECURE_SETTINGS is not an ordinary permission that a Play-distributed app can obtain through a normal runtime dialog. It protects sensitive system.
* [Android File Permissions: Sandbox Access Is Not a Storage Permission](https://apklint.com/blog/android-file-permissions/): Android file access has two layers that are often confused: the app sandbox and access to shared or user-selected content. A storage permission does not.
* [Android External Storage Permissions Across Scoped-Storage Versions](https://apklint.com/blog/android-external-storage-permission/): Android external-storage permissions must be interpreted by device version, target SDK and the kind of data being accessed. Adding READ_EXTERNAL_STORAGE.
* [Files and Media Permission: Choose the Smallest Android Access Model](https://apklint.com/blog/android-files-media-permission/): The phrase “Files and media permission” does not describe one stable Android access model across all versions. Decide whether the app needs a selected.
* [Accessibility Service Permission: Declaration, User Control and Policy](https://apklint.com/blog/android-accessibility-service-permission/): An Android accessibility service is enabled through an explicit user-controlled settings flow. Declaring BIND_ACCESSIBILITY_SERVICE is part of protecting.
* [“Due to Restricted Android Permissions”: Diagnose the Restriction Type](https://apklint.com/blog/restricted-android-permissions/): “Due to restricted Android permissions” is a symptom, not a diagnosis. It can describe a denied runtime grant, a special-access setting, a privileged.
* [Physical Activity Permission on Android: Request Only for the Feature](https://apklint.com/blog/physical-activity-permission/): Physical activity access on Android is feature-specific. Request the relevant activity-recognition permission only when the app uses an API that requires.
* [POST_NOTIFICATIONS on Android: Permission, Channels and Delivery](https://apklint.com/blog/notification-permission/): On Android versions requiring POST_NOTIFICATIONS, notification delivery involves more than a manifest entry. The app's runtime permission, notification.
* [Use Android Photo Picker Instead of Broad Photo Access](https://apklint.com/blog/android-photo-picker/): Android Photo Picker lets a person select media without granting your app broad access to the entire photo library. For an attachment, avatar or one-off.
* [MANAGE_EXTERNAL_STORAGE: Technical Access vs Google Play Eligibility](https://apklint.com/blog/android-all-files-access/): MANAGE_EXTERNAL_STORAGE is broad special access, not the standard fix for every Android file error. First determine whether a picker, MediaStore or.
* [Request Background Location Separately and Explain the Core Feature](https://apklint.com/blog/background-location-permission/): Background location is a separate, sensitive capability. Request it only when the app has a genuine feature that needs location while the user is not.
* [Precise vs Approximate Location: Make Both Paths Work](https://apklint.com/blog/precise-approximate-location/): An Android location feature should remain useful when the user grants approximate rather than precise location, unless precision is truly necessary for the.
* [Bluetooth and Nearby Devices Permissions: Split the Version Paths](https://apklint.com/blog/bluetooth-nearby-permissions/): Bluetooth permissions on Android depend on the operation and platform version. Scanning, connecting and advertising are separate capabilities. A manifest.
* [Camera and Microphone Permissions: Capture Without Over-Requesting](https://apklint.com/blog/android-camera-microphone-permissions/): Camera and microphone access should be requested separately from unrelated capabilities and only for the feature that needs them. A video recorder may need.
* [Android Exact Alarm Permission: Choose the Right Alarm Type](https://apklint.com/blog/android-exact-alarm-permission/): Use an exact alarm only when the user-facing feature genuinely depends on precise timing. Most deferrable synchronization and maintenance tasks should not.
* [Foreground Service Types: Match Permissions to the Actual Work](https://apklint.com/blog/android-foreground-service-types/): A foreground service type describes the actual user-visible work a service performs. It is not a generic label to keep the process alive. Choose the type,.
* [Android Package Visibility: Query Only the Apps You Need](https://apklint.com/blog/android-package-visibility/): Android package visibility limits which installed applications your app can discover through package queries. It is separate from whether an intent can.
* [Manifest Merger Failed: Find the Conflicting Source Before Overriding](https://apklint.com/blog/manifest-merger-failed/): When Android reports “Manifest merger failed,” find the two contributing declarations before applying an override. The merger error is usually telling you.
* [Fix a Missing android:exported Declaration Safely](https://apklint.com/blog/android-exported-missing/): A missing android:exported declaration should be fixed by deciding whether the component is an intended external entry point. Setting every affected.
* [Debuggable Release APK: Inspect the Built Artifact, Not Just Gradle](https://apklint.com/blog/debuggable-release-apk/): To check whether a release APK is debuggable, inspect the built artifact. A Gradle build type named release or a filename containing “production” is not.
* [Validate Android Deep Links and App Links Before Release](https://apklint.com/blog/android-deep-link-validation/): A deep link is untrusted input into your application. Verified Android App Links help associate a web domain with an app, but they do not authorize a user.

### Gradle & Code Quality

* [Gradle Dependency Types: implementation, api and Runtime Configurations](https://apklint.com/blog/gradle-dependency-types/): Gradle dependency configurations answer two questions: where a dependency is available and whether it becomes part of a consumer's contract. In an Android.
* [Gradle Transitive Dependencies: Explain What Entered Your Build](https://apklint.com/blog/gradle-transitive-dependencies/): A transitive dependency enters your build because another dependency requires it. Removing a direct declaration does not necessarily remove the library.
* [Gradle api vs implementation: Control Your Library's Public Classpath](https://apklint.com/blog/gradle-api-vs-implementation/): Use api when a library intentionally exposes another library's types through its public contract. Use implementation when the dependency is an internal.
* [Read a Gradle Dependency Tree and Find the Selected Version](https://apklint.com/blog/gradle-dependency-tree/): A Gradle dependency tree shows requested modules, selected versions and the paths that introduced them. Read the tree for a specific configuration; a.
* [Gradle Sync Failed: Isolate JDK, Plugin, Repository and Network Causes](https://apklint.com/blog/gradle-sync-failed/): “Gradle sync failed” means Android Studio could not complete the build-model import. The last line is rarely the root cause. Find the first actionable.
* [Unable to Find Gradle Tasks to Build: Check Project Import and Plugins](https://apklint.com/blog/unable-find-gradle-tasks/): “Unable to find Gradle tasks to build” often follows an incomplete import or a project opened at the wrong directory level. Before inventing task names,.
* [Update the Android Gradle Plugin as a Compatible Toolchain](https://apklint.com/blog/update-android-gradle-plugin/): Update the Android Gradle Plugin as part of a compatible toolchain, not as an isolated number replacement. AGP, Gradle, the build JDK, Kotlin integration.
* [Latest Android Gradle Versions: Separate AGP from Gradle](https://apklint.com/blog/latest-android-gradle-version/): “Latest Android Gradle version” can mean Gradle itself or the Android Gradle Plugin. They have independent version numbers. As checked on 22 September.
* [Gradle Task Dependencies: dependsOn Is Not mustRunAfter](https://apklint.com/blog/gradle-task-dependencies/): dependsOn adds a task dependency; mustRunAfter only orders tasks that are already scheduled. Confusing them can produce a build that works when two tasks.
* [Where Android Build Dependencies Belong in a Multi-Module Project](https://apklint.com/blog/android-build-gradle-dependencies/): Android build dependencies belong in the module and configuration that use them. Plugin dependencies, application libraries and test libraries are.
* [Root vs App Module build.gradle: Put Each Setting in the Right File](https://apklint.com/blog/android-module-build-gradle/): The root build file coordinates shared build configuration; the app module's build file configures that Android module. Putting applicationId or an.
* [Android Version Catalogs: Share Coordinates Without Hiding Dependencies](https://apklint.com/blog/gradle-version-catalog/): A Gradle version catalog centralizes dependency aliases and version declarations. It improves consistency, but it does not by itself force every resolved.
* [Update the Gradle Wrapper and Verify the Version Used by CI](https://apklint.com/blog/gradle-wrapper-version/): The Gradle Wrapper defines the Gradle distribution a project should use. Updating a globally installed Gradle binary does not necessarily change the.
* [Sentry Android Gradle Plugin: Preserve Mapping Files for Release Reports](https://apklint.com/blog/sentry-android-gradle-plugin/): The Sentry Android Gradle Plugin connects build outputs such as obfuscation mappings and debug information to Sentry's release diagnostics. Adding the.
* [Secrets Gradle Plugin: Avoid Git Leaks Without Claiming APK Secrecy](https://apklint.com/blog/maps-secrets-gradle-plugin/): The Secrets Gradle Plugin helps keep configuration values out of source control. It does not make an API key secret after that key is compiled into an APK..
* [OWASP Dependency-Check with Gradle: Triage Matches, Not Just Scores](https://apklint.com/blog/owasp-dependency-check-gradle/): OWASP Dependency-Check identifies potential known-vulnerability matches in dependencies. A reported match needs applicability review: package.
* [Android Studio Lint: Run the Build-Integrated Check, Not Just a Snippet Scan](https://apklint.com/blog/android-lint-workflow/): Android Lint is a build-aware analysis tool, not just the warning underline in the editor. Run it for the relevant module and variant so manifest, resource.
* [Android Static Code Analysis: Combine Build Context and Focused Checks](https://apklint.com/blog/android-static-code-analysis/): Android static code analysis works best as a set of complementary checks. Android Lint understands Android resources and APIs, Kotlin analyzers can enforce.
* [Java Code Review Checklist for Android: Lifecycles, Errors and Resources](https://apklint.com/blog/java-code-review-checklist/): A Java code review for Android should prioritize ownership, lifecycle and failure behavior before style. Code can be neatly formatted and still leak an.
* [Kotlin Design Patterns for Android: Prefer Clear Ownership Over Ceremony](https://apklint.com/blog/kotlin-design-patterns/): Useful Kotlin design patterns on Android make state, ownership and errors easier to understand. Adding factories, repositories and abstractions everywhere.
* [R8 vs ProGuard: Shrinking, Optimization and Compatible Rules](https://apklint.com/blog/r8-vs-proguard/): R8 is the optimizer used by modern Android builds; ProGuard is a separate Java bytecode shrinker and obfuscator. Their configuration languages overlap, but.
* [minifyEnabled on Android: Test the Release Variant You Actually Ship](https://apklint.com/blog/android-minifyenabled/): minifyEnabled enables code shrinking, optimization and obfuscation for an Android build type. The switch is not merely a file-size preference: it changes.
* [shrinkResources: Remove Unused Assets Without Breaking Dynamic Lookups](https://apklint.com/blog/android-shrinkresources/): shrinkResources removes resources that the Android optimizer determines are unused. It is most effective alongside code optimization, but resources.
* [Android App Obfuscation: Raise Analysis Cost, Do Not Hide Secrets](https://apklint.com/blog/android-app-obfuscation/): Android app obfuscation makes packaged code harder to read by renaming and transforming it. It raises analysis cost; it does not prevent a determined.
* [ProGuard for Java vs R8 for Android: Choose the Correct Pipeline](https://apklint.com/blog/proguard-java-obfuscator/): ProGuard is a Java bytecode shrinker, optimizer and obfuscator. For a modern Android application, R8 is normally the AGP-integrated optimizer; installing.
* [Write Narrow R8 Keep Rules for Reflection and Serialization](https://apklint.com/blog/r8-keep-rules/): A good R8 keep rule preserves the contract that static analysis cannot see without disabling optimization for an entire application. Start from the failing.
* [R8 Missing Classes: Fix the Dependency Before Suppressing the Warning](https://apklint.com/blog/r8-missing-classes/): An R8 missing-class error means the optimizer encountered a reference whose definition was not available in the analyzed inputs. Adding -dontwarn can.
* [Retrace an Obfuscated Android Stack Trace with the Matching Mapping File](https://apklint.com/blog/retrace-obfuscated-stack-trace/): Retrace needs the mapping file from the exact optimized release that produced the crash. A mapping from a newer rebuild can generate plausible-looking but.
* [Resolve Gradle Dependency Conflicts with dependencyInsight](https://apklint.com/blog/gradle-dependency-conflicts/): A dependency conflict occurs when the graph requests incompatible or different versions of a module. The declaration nearest the error is not necessarily.
* [Duplicate Class Build Errors: Find the Two Owners of the Same Class](https://apklint.com/blog/gradle-duplicate-classes/): A duplicate-class error means two packaged inputs define the same class. This is different from requesting two versions of the same module: Gradle can.
* [Lock Gradle Dependencies for Reproducible Release Builds](https://apklint.com/blog/gradle-dependency-locking/): Dependency locking records resolved module versions so a later build does not silently select a different compatible or dynamic version. It improves.
* [Verify Gradle Dependency Checksums Without Trusting the First Download Blindly](https://apklint.com/blog/gradle-dependency-verification/): Gradle dependency verification checks downloaded artifacts against trusted checksums or signatures. Its weakest moment is often the initial trust decision:.
* [Gradle Configuration Cache: Measure Reuse and Fix Incompatible Tasks](https://apklint.com/blog/gradle-configuration-cache/): Gradle's configuration cache reuses the configured task graph between compatible invocations. It is different from the build cache, which reuses task.

### Firebase & App Integrity

* [Set Up Firebase on Android and Verify the Correct App Identity](https://apklint.com/blog/firebase-android-setup/): Firebase setup starts with the Android application's actual package identity, not the project folder name. Registering the wrong applicationId can leave a.
* [Firebase BoM and SDK Versions: Pin a Verified Release, Not a Moving “Latest”](https://apklint.com/blog/firebase-bom-latest-version/): On 22 September 2026, Firebase's Android release notes list BoM 34.19.0, released on 9 September 2026. Treat that as a dated verified value, not a promise.
* [Firebase Google Sign-In on Android: Match Package and Signing Certificates](https://apklint.com/blog/firebase-google-sign-in/): Google Sign-In can work in a debug build and fail after Google Play installation because the package is signed by a different certificate. Check the actual.
* [Configure Firebase Crashlytics in Gradle and Prove a Test Crash Arrives](https://apklint.com/blog/firebase-crashlytics-gradle/): Crashlytics setup is complete only when a controlled crash from the intended build reaches the correct Firebase app with readable information. Adding a.
* [Firebase Crashlytics SDK vs Gradle Plugin: Both Have a Different Job](https://apklint.com/blog/firebase-crashlytics-dependency/): com.google.firebase:firebase-crashlytics is the Android runtime library. The Crashlytics Gradle plugin is a build-time integration. They solve different.
* [Firebase DebugView on Android: Enable, Verify and Turn It Off](https://apklint.com/blog/firebase-debugview-android/): Firebase DebugView is useful for checking development analytics events quickly. It is not evidence that production attribution, consent handling or every.
* [Firebase Performance Monitoring on Android: Measure the Right Trace](https://apklint.com/blog/firebase-performance-android/): Firebase Performance Monitoring is most useful when a trace represents a user-visible task with a clear start and finish. Instrumenting every method.
* [Firebase Performance in Flutter: Instrument a User Task, Not Every Method](https://apklint.com/blog/firebase-performance-flutter/): A Flutter performance trace should follow a meaningful asynchronous operation from start to completion, including its failure and cancellation paths..
* [Firebase App Check in Flutter: Configure Providers Before Enforcement](https://apklint.com/blog/firebase-app-check-flutter/): Firebase App Check in Flutter requires platform-specific provider setup before enforcement. A Dart initialization call alone cannot compensate for the.
* [Firebase App Check in React Native: Native Configuration Still Matters](https://apklint.com/blog/firebase-app-check-react-native/): React Native App Check spans JavaScript, native Android configuration and backend enforcement. A JavaScript package installation can succeed while the.
* [Firebase App Check Pricing and Quotas: Separate Attestation from Backend Usage](https://apklint.com/blog/firebase-app-check-pricing/): App Check cost planning requires separating the Firebase feature, the attestation provider and the backend operations being protected. “App Check is free”.
* [X-Firebase-AppCheck: Validate the Token on Your Custom Backend](https://apklint.com/blog/firebase-x-appcheck-header/): X-Firebase-AppCheck carries an App Check token to a custom backend. Reading the header is not verification: the server must validate the token with a.
* [Android App Attestation: Evidence for a Request, Not a Permanent Trust Badge](https://apklint.com/blog/android-app-attestation/): Android app attestation provides evidence about an app or device environment at a particular point in a request flow. It is not a permanent certificate.
* [Play Integrity on Android: Client Request, Server Verdict and Decision](https://apklint.com/blog/play-integrity-android/): A Play Integrity integration has three parts: the Android client requests evidence, the backend validates the returned token, and the backend applies a.
* [com.google.android.play:integrity: Add the Library Without Skipping Backend Setup](https://apklint.com/blog/play-integrity-dependency/): com.google.android.play:integrity is the Android client library coordinate for Play Integrity. Adding it does not automatically connect the correct Cloud.
* [Read Play Integrity Verdicts Without Reducing Them to One Boolean](https://apklint.com/blog/play-integrity-verdicts/): A Play Integrity response is structured evidence, not a single universal “safe device” boolean. Interpret each documented field in the context of the.
* [Use Firebase App Check Debug Tokens Without Shipping a Bypass](https://apklint.com/blog/firebase-app-check-debug-provider/): The App Check debug provider is a development mechanism, not a production attestation provider. A registered debug token can authorize development traffic,.
* [Enable App Check Enforcement After Measuring Legitimate Traffic](https://apklint.com/blog/firebase-app-check-enforcement/): Enable App Check enforcement after measuring legitimate traffic and validating supported release paths. Turning it on before older supported app versions.
* [Firebase Config and API Keys: Public Identifiers vs Real Access Controls](https://apklint.com/blog/firebase-config-api-key-security/): Firebase API keys generally identify a project for supported client APIs; they are not a substitute for authentication or authorization. Finding one in an.
* [google-services.json: Package Matching, Build Variants and Safe Handling](https://apklint.com/blog/firebase-google-services-json/): google-services.json is processed during the Android build to select Firebase configuration for the app. Changing a file on a remote website does not.
* [Audit Firebase Security Rules Separately from APK Configuration](https://apklint.com/blog/firebase-security-rules-audit/): A Firebase Security Rules audit should start from the data operations each user is allowed to perform. Finding a Firebase URL in an APK is not enough to.
* [Crashlytics Not Reporting Crashes: Diagnose the Delivery Path](https://apklint.com/blog/crashlytics-missing-crash-reports/): When Crashlytics does not show a crash, diagnose the delivery path before reinstalling libraries repeatedly. The report may target another Firebase app, be.
* [Crashlytics Mapping Files: Match the Exact Release Variant](https://apklint.com/blog/crashlytics-mapping-file/): Crashlytics needs the R8 mapping associated with the exact release to reconstruct obfuscated Java/Kotlin frames. A mapping upload from a different flavor.
* [Play Integrity Standard Requests: Bind Verdicts to Server-Side Actions](https://apklint.com/blog/play-integrity-standard-request/): A Play Integrity standard request should be tied to the server-side action being protected. Obtaining a valid token without checking its relationship to.
* [Firebase KTX Migration: Main Modules After BoM 34](https://apklint.com/blog/firebase-ktx-migration/): Firebase stopped releasing separate Android KTX modules in July 2025 and removed them from BoM 34.0.0. Current Kotlin integrations should use the supported.

### Performance & Crash Debugging

* [TransactionTooLargeException: Reduce Binder Payloads, Not Heap Usage](https://apklint.com/blog/transaction-too-large-exception/): TransactionTooLargeException usually points to an oversized Binder transaction, such as a large saved-state bundle or intent payload. Increasing the app's.
* [Android NullPointerException: Read the Throw Site and Restore the Missing State](https://apklint.com/blog/android-null-pointer-exception/): An Android NullPointerException is a failed assumption about a value at a specific point in execution. Replacing every access with a safe call can stop the.
* [Android Crash Reports: Capture a Useful Trace Without Leaking User Data](https://apklint.com/blog/android-crash-reports/): A useful Android crash report identifies the exact build, failure and reproduction context without exposing the user's private data. A screenshot saying.
* [Android Studio Network Profiler: What It Captures and What It Misses](https://apklint.com/blog/android-network-profiler/): The Android Studio feature often searched as “Network Profiler” is documented as Network Inspector. It helps inspect supported app network traffic, but an.
* [Android App Performance Testing: Build a Repeatable Device Matrix](https://apklint.com/blog/android-performance-testing/): Android performance testing needs a repeatable workload and device matrix. A single fast run on a developer's flagship phone cannot establish acceptable.
* [Check Android App Memory Usage: PSS, Heap and Allocation Are Different](https://apklint.com/blog/android-check-memory-usage/): Android app memory cannot be summarized accurately by one number labelled “RAM.” Java/Kotlin heap, native allocations, graphics memory and proportional.
* [Android Performance Monitoring: Combine Field Metrics with Local Traces](https://apklint.com/blog/android-performance-monitoring/): Production monitoring and local profiling answer different questions. Monitoring identifies which users and releases are affected; profiling explains what.
* [Optimize Android App Performance by Fixing the Measured Bottleneck](https://apklint.com/blog/android-performance-optimization/): Optimize the measured bottleneck, not the most fashionable part of the stack. A slow screen caused by image decoding will not necessarily improve after.
* [Debug Android ANRs: Start with the Blocked Main Thread](https://apklint.com/blog/android-anr-debugging/): An Android ANR indicates that a component failed to respond within a system-defined expectation. Start by determining what the main thread was waiting for.
* [Android Cold Start: Separate Time to Initial Display from Fully Drawn](https://apklint.com/blog/android-cold-start/): Cold-start optimization should distinguish time to the first displayed frame from time to a genuinely usable screen. Showing a shell quickly while.
* [Android Baseline Profiles: Accelerate Critical Paths, Then Benchmark](https://apklint.com/blog/android-baseline-profiles/): Baseline Profiles identify important code paths so supported Android runtime compilation can improve execution of those paths. They do not remove.
* [Android Jank: Find the Long Frame Before Changing Layouts](https://apklint.com/blog/android-jank-rendering/): Jank is a missed frame deadline, not simply a large layout file. Find the work that made a particular frame late before replacing UI components or adding.
* [Find Android Memory Leaks by Following Retained References](https://apklint.com/blog/android-memory-leaks/): A memory leak exists when an object remains reachable longer than its intended lifetime. A rising chart alone is not enough: caches, delayed cleanup and.
* [Android OutOfMemoryError: Diagnose Allocation Pressure and Retention](https://apklint.com/blog/android-out-of-memory/): An OutOfMemoryError can result from a large single allocation, excessive temporary allocation or objects retained too long. The failing allocation is often.
* [Investigate Android Battery Drain with Work, Network and Wake-Lock Evidence](https://apklint.com/blog/android-battery-drain/): Android battery drain is often the accumulated cost of work that runs too frequently or continues after it is useful. Start with wake locks, background.
* [Android Vitals Crash Rate: Read the Metric Population Before Prioritizing](https://apklint.com/blog/android-vitals-crash-rate/): Android vitals crash rates and a third-party crash dashboard can differ because their populations and denominators differ. Compare definitions before.
* [Android Vitals ANR Rate: Why Local Success Does Not Clear a Release](https://apklint.com/blog/android-vitals-anr-rate/): A release that does not freeze on your test phone can still have a high ANR rate in the field. Lower-end devices, resource pressure and rare scheduling.
* [Filter Android Logcat for One Reproduction Without Losing the Cause](https://apklint.com/blog/android-logcat-filtering/): Logcat filtering should remove noise without deleting the event that explains the failure. A filter showing only the app's final exception can hide an.
* [Android SecurityException: Match the Permission, UID and API Contract](https://apklint.com/blog/android-securityexception/): SecurityException means an operation violated an access or security contract. The cause can be a missing permission, wrong caller identity, restricted API,.
* [ActivityNotFoundException: Resolve the Intent and Provide a Fallback](https://apklint.com/blog/android-activitynotfoundexception/): ActivityNotFoundException occurs when an intent cannot be handled as requested. The target may be absent, the action/data combination may not match, or an.
* [NetworkOnMainThreadException: Move Blocking Work Off the UI Thread](https://apklint.com/blog/network-on-main-thread/): NetworkOnMainThreadException points to a blocking network operation on the UI thread under Android's applicable checks. Disabling the check does not make.
* [Android ClassNotFoundException: Check Packaging, Loading and Shrinking](https://apklint.com/blog/android-classnotfoundexception/): ClassNotFoundException means a loader could not find a requested class by name. The class may be missing from the artifact, renamed or removed by.
* [NoSuchMethodError on Android: Detect Binary Dependency Mismatches](https://apklint.com/blog/android-nosuchmethoderror/): NoSuchMethodError usually indicates a binary compatibility mismatch: compiled code calls a method that the runtime class definition does not provide. It is.
* [Android Macrobenchmark: Compare Releases Without Debug-Build Noise](https://apklint.com/blog/android-macrobenchmark/): Macrobenchmark measures larger Android interactions such as startup and scrolling against a target app. Its value comes from controlled setup and.

### Flutter, React Native & Unity

* [Flutter Security Best Practices: The APK Is Not a Secret Store](https://apklint.com/blog/flutter-security-best-practices/): A Flutter APK is a distributable client, not a secret vault. Dart obfuscation can make names harder to interpret, but privileged credentials and.
* [Decompile a Flutter APK: Native Structure, Dart AOT and Recovery Limits](https://apklint.com/blog/decompile-flutter-apk/): A Flutter release APK commonly contains compiled Dart application code and the Flutter engine alongside ordinary Android components. A Java decompiler can.
* [Set Flutter minSdk Without Confusing It with targetSdk](https://apklint.com/blog/flutter-min-sdk/): Flutter's minSdk determines the oldest Android platform the app supports. It is different from targetSdk, which participates in Android behavior.
* [Publish a Flutter App to Google Play: Release Identity and Testing](https://apklint.com/blog/flutter-play-store-release/): Publishing a Flutter app to Google Play requires more than generating an AAB. The release must have the correct package, upload key, version, current.
* [Flutter vs Native Performance: Compare the Workload, Not Framework Labels](https://apklint.com/blog/flutter-vs-native-performance/): Flutter versus native performance is a workload comparison, not a single framework ranking. A result from one scrolling demo does not establish which.
* [Reduce Flutter APK Size with a Size Analysis, Not a Debug APK Comparison](https://apklint.com/blog/flutter-apk-size/): Measure Flutter app size using a release build and a defined distribution target. Comparing a debug APK with a device-specific Play download exaggerates.
* [Flutter Dart Obfuscation: Preserve Symbols and Understand Its Limits](https://apklint.com/blog/flutter-dart-obfuscation/): Flutter Dart obfuscation renames symbols in supported release outputs. It does not encrypt assets, remove all strings or make embedded credentials safe,.
* [flutter build apk vs appbundle: Pick the Output for the Distribution Channel](https://apklint.com/blog/flutter-build-apk-vs-appbundle/): Use a Flutter APK when you need an installable Android package for an appropriate distribution or test workflow. Use an Android App Bundle for a Play.
* [Flutter Android Build Failures: Diagnose the Underlying Gradle Error](https://apklint.com/blog/flutter-android-build-failure/): A Flutter Android build failure often ends with a generic Gradle message while the actual cause appears earlier. Find the first meaningful Android or.
* [Build a React Native Release APK and Verify the JavaScript Bundle](https://apklint.com/blog/react-native-build-apk/): A React Native release APK must contain the JavaScript or Hermes bytecode and assets needed to run without the development server. A build that launches.
* [React Native assembleRelease: Variant Output, Signing and Install Checks](https://apklint.com/blog/react-native-assemble-release/): assembleRelease is an Android Gradle task that assembles a release APK for the relevant module. It does not upload the app to Google Play, create every.
* [Build an Expo Android APK for Device Testing with EAS](https://apklint.com/blog/react-native-expo-apk/): EAS Build normally targets an Android App Bundle for store distribution. To install a build directly on a device or emulator, configure an APK-producing.
* [Submit an Expo App to Google Play Without Confusing Upload with Release](https://apklint.com/blog/expo-google-play-submit/): EAS Submit uploads an Android build to Google Play using the configured submission workflow. Upload completion is not the same as policy approval,.
* [Publish a Bare React Native App to Google Play](https://apklint.com/blog/react-native-play-store-release/): Publishing a bare React Native app requires a reproducible Android release, correct signing and a tested Play-delivered installation. JavaScript code.
* [React Native Android Widgets: Native Host, Shared Data and Update Limits](https://apklint.com/blog/react-native-android-widget/): An Android home-screen widget is hosted by the Android launcher and follows native widget constraints. It is not simply a React Native screen rendered.
* [Inspect a React Native APK with Hermes: Bytecode Is Not Original Source](https://apklint.com/blog/react-native-hermes-apk/): A React Native APK using Hermes can contain precompiled JavaScript bytecode rather than readable original JavaScript. Seeing that bytecode does not mean an.
* [Reduce React Native Android Size Without Removing Required ABIs](https://apklint.com/blog/react-native-apk-size/): React Native APK size includes the JavaScript bundle, native engine, native modules, Android resources and assets. Reducing only JavaScript text may have.
* [React Native Native-Module Crashes: Follow the Android Exception](https://apklint.com/blog/react-native-native-module-crash/): A React Native native-module crash may surface in JavaScript while the underlying failure is an Android exception, JNI problem or incompatible native.
* [Expo Android Credentials: Match EAS Upload Keys to Play App Signing](https://apklint.com/blog/expo-android-credentials/): Expo Android credentials and Google Play App Signing must agree on the upload identity for an existing app. Creating a new keystore because a build machine.
* [Build a Unity Android APK: Choose the Backend, Architecture and Signing](https://apklint.com/blog/unity-build-android-apk/): A Unity Android APK is defined by more than the Build button: scripting backend, architectures, scenes, package identity and signing all affect the result..
* [Unity Gradle Build Failed: Find the First Android Build Error](https://apklint.com/blog/unity-gradle-build-failed/): “Gradle build failed” is usually Unity's final wrapper message, not the root cause. The meaningful error often appears earlier in the editor/build log and.
* [Decompile a Unity APK: Mono vs IL2CPP Changes What Is Recoverable](https://apklint.com/blog/decompile-unity-apk/): Unity APK analysis depends strongly on the scripting backend. Managed assemblies from a Mono build and native output from IL2CPP present different recovery.
* [APK to Unity Project: Why Extracted Assets Do Not Restore the Editor Project](https://apklint.com/blog/apk-to-unity-project/): An APK is a deployment artifact, not a Unity project backup. Extracting packaged assets and code cannot reliably recreate the original editor project,.
* [Reduce Unity Android Build Size with Asset and Native-Library Evidence](https://apklint.com/blog/unity-apk-size/): Unity Android size optimization starts with the build report and packaged contributors, not a blanket instruction to lower every quality setting. Textures,.
* [Unity IL2CPP vs Mono on Android: Build Artifacts and Diagnostic Tradeoffs](https://apklint.com/blog/unity-il2cpp-vs-mono/): Unity's Mono and IL2CPP backends produce different runtime artifacts and debugging workflows. Choose a backend based on the supported target, plugin.
* [Unity Managed Stripping: Keep Reflective Entry Points Without Disabling Everything](https://apklint.com/blog/unity-managed-stripping/): Unity managed stripping removes code the linker considers unreachable. Reflection, serialization and runtime-selected types can require explicit.
* [Unity Play Asset Delivery: Separate Game Assets from the Base Module](https://apklint.com/blog/unity-play-asset-delivery/): Play Asset Delivery separates game assets from the base install and supports documented delivery modes. It changes the asset lifecycle, so the game must.
* [Unity Android 16 KB Page Sizes: Check Engine and Native Plugins Together](https://apklint.com/blog/unity-android-16kb/): Unity Android 16 KB page-size compatibility depends on the engine and every packaged native library, including third-party plugins. Updating Unity alone.
* [Unity Android Release Crashes: Keep Native Symbols for the Exact Build](https://apklint.com/blog/unity-release-crash-symbols/): A Unity Android release crash needs symbols from the exact native build to turn addresses into useful locations. A symbol archive from the same source but.

### Google Play Publishing

* [compileSdk Explained: Compile-Time APIs Are Not Your Minimum Android Version](https://apklint.com/blog/compile-sdk-version/): compileSdk chooses the Android API definitions available while compiling an app. It does not specify the oldest Android version allowed to install it, and.
* [Google Play Target API Requirements: September 2026 Checklist](https://apklint.com/blog/play-target-api-requirements/): As checked on 22 September 2026, Google Play's standard new-app and app-update requirement is Android 16 / API 36, effective 31 August 2026. Existing-app.
* [Google Play and minSdk: Device Availability Is Not the Target-API Deadline](https://apklint.com/blog/min-sdk-google-play/): Google Play's target-API deadline does not require setting minSdk to the same Android version. minSdk controls the oldest platform your app supports;.
* [targetSdkVersion: Audit Behavior Changes Before Raising the Number](https://apklint.com/blog/target-sdk-behavior-changes/): Increasing targetSdkVersion is a behavior migration, not only a manifest edit. Some Android changes apply to every app on a new OS; others activate when.
* [“Phone Not Compatible with App”: Separate SDK, Hardware and Store Filters](https://apklint.com/blog/phone-not-compatible-app/): “Phone not compatible with app” is a symptom, not a diagnosis. It can describe an OS minimum, missing hardware, unsupported CPU architecture, incomplete.
* [Android App Compatibility Testing: Go Beyond minSdk](https://apklint.com/blog/android-app-compatibility-testing/): Android compatibility testing should answer whether the app's important tasks work across the devices you claim to support. A manifest with a low minSdk is.
* [Complete Google Play Data Safety from Actual Data Flows](https://apklint.com/blog/play-data-safety/): Google Play Data Safety is a declaration of what your app and its included SDKs actually do with user data. It is not generated correctly by selecting “no.
* [Add or Update a Google Play Privacy Policy URL That Matches the App](https://apklint.com/blog/play-privacy-policy-url/): A Google Play privacy policy URL must lead reviewers and users to a readable policy for the actual app. Updating the URL in Console does not update the.
* [Google Play Developer Identity Verification: Match the Account Evidence](https://apklint.com/blog/play-developer-identity-verification/): Google Play developer verification concerns the real person or organization responsible for the account. The public developer display name can differ from.
* [Android Developer Verification in September 2026: Scope and Rollout Dates](https://apklint.com/blog/android-developer-verification-2026/): Android developer verification has a staged rollout. As checked on 22 September 2026, the next published milestone is 30 September 2026, initially covering.
* [Google Play Screenshot Requirements: Build a Device-Specific Asset Checklist](https://apklint.com/blog/play-screenshot-requirements/): Google Play screenshot requirements depend on the device type and on whether you mean basic listing acceptance or eligibility for promotional placements. A.
* [Google Play Age Ratings: Complete the Questionnaire for the Actual Content](https://apklint.com/blog/play-age-content-ratings/): Google Play content ratings are calculated from the questionnaire about the app's actual content and features. They are not a marketing age range chosen to.
* [Google Play Account Suspended: Build an Evidence-Based Appeal](https://apklint.com/blog/play-account-suspended/): An app rejection, an app suspension and a developer-account termination are different enforcement actions. Before drafting an appeal, identify the exact.
* [Remove an App from Google Play: Unpublish vs Delete vs Remove a Release](https://apklint.com/blog/remove-app-play-console/): Removing an app from Google Play can mean stopping new downloads, discarding a draft release or deleting an eligible app record. Those actions have.
* [Delete an App Bundle in Play Console: Release State and Version-Code Limits](https://apklint.com/blog/delete-app-bundle-play-console/): Removing an Android App Bundle from a release is not the same as erasing its uploaded history. Play Console tracks artifacts, version codes and release.
* [Google Play Developer Policies: Maintain a Product-Level Compliance Register](https://apklint.com/blog/play-developer-policies/): A useful Google Play policy process ties each requirement to a real app feature and an accountable owner. A long copied checklist becomes unreliable when.
* [“Not Adhering to Developer Policies”: Turn the Notice into a Reproducible Fix](https://apklint.com/blog/play-policy-violation-response/): “Not adhering to Google Play developer policies” is too broad to fix by changing random permissions. The actionable evidence is the cited policy, affected.
* [Play Console Policy Status: Track Issues by App, Release and Deadline](https://apklint.com/blog/play-policy-status-workflow/): Play Console's Policy status is a work queue, not a universal health certificate. An empty list of active issues does not establish that every future.
* [Android App Launch Checklist: Artifacts, Access, Policy and Rollback](https://apklint.com/blog/android-app-launch-checklist/): An Android launch checklist should make a release recoverable, not merely uploadable. The essential question is whether the team can identify the shipped.
* [Google Play Submission Requirements: Assemble a Review-Ready App](https://apklint.com/blog/play-store-submission-requirements/): A Google Play submission includes more than a signed bundle. The account, app content declarations, listing assets, review access, release track and.
* [Submit an Android App to Google Play Without Skipping the Review Gates](https://apklint.com/blog/submit-android-app-play/): Submitting an Android app to Google Play is a sequence of reviewable states: create the app record, complete required content, prepare a release, resolve.
* [Google Play Closed Testing Requirements for New Personal Accounts](https://apklint.com/blog/play-closed-testing-requirements/): As checked on 22 September 2026, Google's published requirement for personal Play developer accounts created after 13 November 2023 is a closed test with.
* [Third-Party SDKs in Data Safety: Reconcile Code, Configuration and Disclosures](https://apklint.com/blog/play-data-safety-sdk-disclosures/): Third-party SDK disclosures must be reconciled with the SDK versions and settings inside your actual app. A vendor's generic guide may describe.
* [Google Play Account Deletion: App Flow, Web Link and Retention Disclosure](https://apklint.com/blog/play-account-deletion/): For apps within Google Play's account-creation policy scope, account deletion needs a discoverable request path and an external web resource. Logging out,.
* [Google Play Families Policy: Audience, SDKs, Ads and Data](https://apklint.com/blog/play-families-policy/): Google Play Families requirements depend on the app's actual audience and experience, not whether the developer selected an adult age group to avoid extra.
* [Google Play Permission Declarations: Prove the Core Functionality](https://apklint.com/blog/play-sensitive-permission-declaration/): A sensitive permission declaration should demonstrate why the app's core functionality requires that access and why a narrower alternative is insufficient..
* [Use a Google Play Staged Rollout with Measurable Stop Conditions](https://apklint.com/blog/play-staged-rollout/): A staged rollout limits how quickly an update reaches eligible users; it does not make a faulty release harmless. Users who already received the update can.
* [Give Google Play Reviewers Working App Access and Reliable Instructions](https://apklint.com/blog/play-review-app-access/): Google Play reviewers need reliable access to every restricted part of the app. A valid password is insufficient when the account requires a one-time code,.

### Ads, ASO & Accessibility

* [AD_ID in AndroidManifest.xml: Declaration, SDK Merging and Play Disclosure](https://apklint.com/blog/ad-id-manifest-permission/): com.google.android.gms.permission.AD_ID is a manifest declaration associated with access to Android's advertising ID. It is not a runtime permission.
* [Android Advertising ID: Availability, Resets and Permitted Use](https://apklint.com/blog/android-advertising-id/): Android's advertising ID is a user-resettable advertising identifier, not a durable account key. It can be unavailable or deleted, and applications must.
* [AdMob Android Integration: Keep Legacy and Next-Gen SDK Instructions Separate](https://apklint.com/blog/admob-android-integration/): Google's current Android documentation separates the Google Mobile Ads SDK (Legacy) from the GMA Next-Gen SDK. They use different dependency coordinates.
* [AdMob Test App ID vs Ad Unit ID: Avoid the Tilde-Slash Mix-Up](https://apklint.com/blog/admob-test-app-id/): An AdMob app ID identifies the application in the SDK setup. An ad-unit ID identifies a placement and format. Their similar prefixes hide an important.
* [AdMob Banner Test IDs: Select the Correct Format and Never Click Live Ads](https://apklint.com/blog/admob-test-banner-id/): Use Google's official demo ad units or configured test devices when testing banners. A working banner is not permission to click live ads repeatedly. Test.
* [AdMob Mediation on Android: Verify Adapters, Consent and Test Coverage](https://apklint.com/blog/admob-mediation-android/): AdMob mediation adds more than an extra dependency. Each network can require an adapter, a compatible SDK version, account-side configuration, privacy.
* [Google Mobile Ads in Unity: Plugin, Android Dependencies and Test Ads](https://apklint.com/blog/google-mobile-ads-unity/): Google Mobile Ads in Unity has two layers: the C# plugin and the native Android dependencies resolved into the exported build. A plugin imported.
* [Mobile Ads SDK Audit: Versions, Collection and Unused Adapters](https://apklint.com/blog/mobile-ads-sdk-audit/): A mobile ads SDK audit should identify what ships, when it starts and what data or permissions it introduces. Searching source code for one AdMob import.
* [AdMob UMP on Android: Refresh Consent and Gate Ad Requests Correctly](https://apklint.com/blog/admob-ump-consent/): A correct Android UMP integration refreshes consent information and gates ad work using the SDK's current result. Showing a form once and storing a.
* [AdMob Data Safety: Use SDK Disclosures and Your Actual Configuration](https://apklint.com/blog/admob-data-safety/): AdMob's Data Safety disclosure is not simply “advertising ID collected: yes or no.” The relevant Mobile Ads SDK can handle interaction, diagnostic, network.
* [Use Ad Inspector to Separate SDK Integration Issues from Ad Availability](https://apklint.com/blog/admob-ad-inspector/): Ad Inspector helps investigate an ads integration, but it does not guarantee that a production request will receive an ad. Its value is separating SDK.
* [Google Play Store Optimization: Improve Relevance and Conversion Without Stuffing](https://apklint.com/blog/google-play-store-optimization/): Google Play store optimization should improve how accurately the listing communicates the product and how confidently the right users choose it. Repeating.
* [Google Play Title and Short Description: Write Within Limits and Match Intent](https://apklint.com/blog/play-title-short-description/): Google Play's current limits are 30 characters for the app name, 80 for the short description, and 4,000 for the full description. These are ceilings, not.
* [Google Play Keyword Research: Separate Store Search from Web Search Demand](https://apklint.com/blog/play-keyword-research/): Google Play keyword research and Google web keyword research measure different environments. A phrase with demand in Google Ads Keyword Planner is not.
* [Google Play Store Listing Experiments: Test a Hypothesis, Not Everything at Once](https://apklint.com/blog/play-listing-experiments/): A Google Play store listing experiment should test a specific hypothesis about presentation. Changing the icon, screenshots, description, price and.
* [Android Accessibility Tools: Scanner, TalkBack and Manual Testing](https://apklint.com/blog/android-accessibility-tools/): No single Android accessibility tool can determine whether users can complete every important task. Combine on-device assistance, automated checks and.
* [Android Accessibility Testing: A Task-Based Release Checklist](https://apklint.com/blog/android-accessibility-testing/): An Android accessibility test plan should follow user tasks through success, error and recovery states. Checking only the first screen misses barriers such.
* [Android Touch Targets and Contrast: Fix Interaction Barriers, Not Just Scores](https://apklint.com/blog/android-touch-target-contrast/): A small icon can have a usable touch target, and a large-looking button can still be hard to activate. Measure the interactive area and its spacing, not.

### Archive pagination

* [Page 2](https://apklint.com/blog/page/2/)
* [Page 3](https://apklint.com/blog/page/3/)
* [Page 4](https://apklint.com/blog/page/4/)
* [Page 5](https://apklint.com/blog/page/5/)
* [Page 6](https://apklint.com/blog/page/6/)
* [Page 7](https://apklint.com/blog/page/7/)
* [Page 8](https://apklint.com/blog/page/8/)
* [Page 9](https://apklint.com/blog/page/9/)
* [Page 10](https://apklint.com/blog/page/10/)
* [Page 11](https://apklint.com/blog/page/11/)