APK Manifest Metadata Inspector

How to use APK Manifest Metadata Inspector

Inspect the package’s declared Manifest source without installing it or uploading the archive. The report decodes the selected Android binary XML profile, retains all original string/type/reference evidence, and groups named package, SDK, permission and component entries. Resource references and Android runtime behavior remain explicitly unassessed.

1. Choose the local APK whose declared Manifest you want to review. Load example creates an original structural Manifest-only container; it has no executable app and is not installable.
2. Run to read the selected root Manifest in a local module Worker. Review its source hash, encoding, complete structural counts and the stated inspection scope.
3. Download the evidence ZIP: manifest-evidence.json contains every decoded source string/event/attribute and original reference word; manifest-attributes.csv is a spreadsheet-protected attribute table; AndroidManifest.axml preserves the exact compiled bytes.
4. Use the original Android SDK or your own trusted application review for resource resolution, merged/runtime permissions, signatures, installation or execution. Reset cancels this local operation and clears the current result.

Good to know

• One actual File, 22 bytes–16 MiB; a nonempty single-line name up to 200 UTF-16 units. Classic single-disk unencrypted non-ZIP64 directory only: 10,000 entries, 2 MiB central data, raw names at most 1,024 bytes. Duplicate raw member names and NUL/invalid declared UTF-8 names refuse. Exactly one raw ASCII root AndroidManifest.xml is required; AAB/protobuf XML is unsupported.
• Only the selected Manifest local/central/descriptor records, decompressed size and CRC32 are checked. Stored/DEFLATE Manifest data is at most 512,000 compressed and expanded bytes. Other members, signing gaps, application code and complete archive integrity are unassessed. No archive member is written to a filesystem or executed.
• Selected compiled XML only: one exact document and initial UTF-8/UTF-16LE string pool, optional resource map, known namespace/element/CDATA events and 20-byte attributes. Styled string pools, future chunks, extended headers/strides, malformed Unicode/lengths/terminators, bad references, inconsistent scopes/closures and duplicate expanded attributes refuse the whole operation.
• At most 10,000 pool strings, 2,000 UTF-16 units per string, 200,000 decoded units, 10,000 chunks, 5,000 node events, 60 element levels, 100 attributes per element and 10,000 attributes overall. Original string-start BOM characters stay characters. Older truncated-length encodings beyond these string caps are unsupported.
• The JSON preserves the full string pool, resource-map words, comments, source lines/byte offsets, namespace events, element order, parent identities, raw values and typed data. Named groups use literal source names; they do not certify Android resource-ID interpretation, component resolution, manifest merging, default exported/debuggable values or granted permissions. Resources.arsc and dynamic references are not resolved; complex/color words remain exact unmodeled data.
• Floating-point values retain their exact raw 32-bit word; nonfinite values and negative zero have explicit string displays. Raw and typed strings can differ and both remain evidence. A package name or version here is a supplied declaration, not proof of identity, authenticity, compatibility or behavior.
• Reads have a 5-second waiting deadline. ZIP-library preparation has a separate 10 seconds before bytes are posted; Worker computation then has 2 seconds. Reset/pagehide cancel ownership and prevent a late read from starting a Worker. Underlying browser File reads are not claimed abortable. The page’s bounded SHA/ZIP/UTF-8/JSON result verification is not an interruptible parser or fixed phone heap guarantee.
• Complete JSON and attribute CSV are each at most 2 MiB; the stored three-file ZIP is at most 5 MiB. JSON is token-budgeted before joining so repeated source strings cannot first allocate an unbounded serialized artifact. The visible result is a short summary; complete evidence is in the download. No partial artifact is returned if any limit fails.
• All nonempty original string CSV cells receive an apostrophe and every cell is quoted. Non-newline C0 controls and DEL display as literal \uXXXX; CR/LF remain inside quoted cells. JSON and the raw compiled file retain exact values; import CSV as text. Source strings and filenames may be private. This is an inventory rather than a sanitizer, malware scan, certificate/signature verifier, decompiler, installer or payment tool. Nothing is fetched, uploaded, automatically saved or mounted as HTML/XML in this app.