APKMan

Reverse engineer Android APKs directly in your browser.
No uploads. No servers. No installs. Everything runs client-side.

Live Demo →

---

Drop an APK → explore manifest, decompile DEX, browse resources, verify signatures — all in one tab.

Features

🔍 Manifest Parser Decode binary AndroidManifest.xml to readable XML. Permissions, activities, services, receivers, providers, intent filters — everything at a glance.	☕ DEX → Java Decompiler Full DEX-to-Java decompilation via Rust → WebAssembly. Structured control flow, SSA IR, type inference, expression simplification. Smali view included.
📦 Resource Browser Parse resources.arsc, browse string tables, view images inline, decode binary XML from res/.	🔐 Signature Verification Inspect signing certificates — issuer, subject, validity, fingerprints (MD5 / SHA-1 / SHA-256), scheme versions.
📂 File Tree + Code View Full ZIP extraction with folder tree, file sizes, syntax highlighting via Monaco Editor.	💾 Instant Cache IndexedDB-backed cache (SHA-256 keyed). Re-open previously analyzed APKs instantly.
🔎 Global Search Ctrl+K to search across permissions, string resources, class names, and method names. Results grouped by category with click-to-navigate.	📊 APK Comparison Load two APKs side-by-side. Diff permissions, classes, manifest entries, and file sizes at a glance.
📥 Export as ZIP One-click export of decoded manifest, resource XMLs, string tables, and all Smali source files.	⚡ Web Worker Parsing Heavy parsing runs off the main thread with real-time progress. UI stays buttery smooth on large APKs.
🧩 Multi-DEX Support Seamless handling of classes.dex, classes2.dex, … — per-DEX filtering, merged class list, source labels.	📱 PWA & Offline Install as a native app. Service worker caches everything including the WASM module — works fully offline.

Architecture

APK File (browser File API)
│
├─ Web Worker ─────────── Off-main-thread parsing pipeline
│   │
│   ├─ JSZip ──────────── ZIP extraction + file tree
│   ├─ AXML Parser ────── Binary XML → readable XML (pure JS)
│   ├─ DEX Parser ─────── DEX headers, strings, types, classes (pure JS)
│   ├─ Resource Parser ── resources.arsc → string/resource tables (pure JS)
│   └─ Signature Parser ─ PKCS#7 certificates + fingerprints (pure JS)
│
├─ DEX Decompiler ─────── Rust → WASM (331 KB)
│   └─ CFG → SSA IR → Region Tree → Java source
│
├─ IndexedDB Cache ────── SHA-256 keyed, instant reload
│
└─ Service Worker ─────── Offline-first caching strategy

Everything runs client-side. Your APK files never leave your browser.

Tech Stack

Layer	Technology
Framework	Next.js 16 (App Router, Turbopack)
UI	React 19 · shadcn/ui · Tailwind CSS 4
Language	TypeScript 5
Decompiler	Rust → WASM (androguard/dex-decompiler)
ZIP	JSZip
Code View	Monaco Editor
Storage	IndexedDB
Offline	Service Worker + Web App Manifest

Getting Started

git clone https://github.com/jiusanzhou/apkman.git
cd apkman
npm install
npm run dev

Open http://localhost:3000 and drop an APK.

Production Build

npm run build
npm start

Building the WASM Decompiler

Pre-built binary included in public/wasm/. To rebuild from source:

cd vendor/dex-wasm
wasm-pack build --target web --release
cp pkg/dex_wasm_bg.wasm ../../public/wasm/
cp pkg/dex_wasm.js ../../public/wasm/

Requires Rust + wasm-pack.

Roadmap

• Global search (permissions, classes, strings, methods)
• Multi-DEX improved handling
• APK comparison / diff
• Export decompiled source as ZIP
• Web Worker parsing for large APKs
• PWA offline support
• Decompiled Java source (currently Smali only for export)
• Shareable analysis links (hash-based)
• Browser extension for one-click analysis

License

MIT

---

Built by @jiusanzhou