APK X-Ray Open the app before you trust it.
A reverse-engineering triage station in your browser. Manifest, DEX, signature, permissions and connections are turned into readable evidence, without sending the file off your device.
Ver relatório de exemplo Dados fictícios · sem selecionar arquivo
Exemplo: app de notas fictício
Estes dados são ilustrativos. Não são resultados de uma análise do seu APK.
- Permissão: localização precisa
android.permission.ACCESS_FINE_LOCATION- Permite pedir acesso à localização. Isso não comprova coleta: compare com a função declarada do app.
- SDK de análise de uso
- Uma biblioteca de telemetria aparece no código do app fictício. Isso indica uma capacidade possível, não que dados tenham sido enviados.
- Assinatura de debug
- Em um APK distribuído ao público, é um sinal para conferir a origem e o certificado. Sozinha, a assinatura de debug não prova adulteração.
Esses indícios ajudam na triagem; não substituem uma análise completa nem garantem segurança.
A análise real usa o APK que você escolher, localmente no navegador. Este exemplo não lê arquivos nem gera uma exportação.
—
—
Full verdict is VIP
You already see the summary above. Unlock the full X-ray of this APK:
A security report — not a list of data
Each analysis becomes a verdict with cause and effect. It's the reading a security analyst would do by hand, over hours of reverse engineering, delivered in seconds.
A–F risk verdict
A score from 0 to 100 with the reasons behind it — not just loose numbers.
Modified-APK detection
Spots debug signatures and tampering — the classic sign of a mod, crack or injected malware.
Trackers & SDKs
Finds Firebase, AdMob, Facebook, Unity and dozens of telemetry SDKs inside the code.
Secrets in the code
Extracts embedded URLs, IPs, emails and API keys — where the app actually connects.
Privacy label
Shows what the app accesses: location, microphone, camera, SMS, contacts and more.
Permissions explained
Every dangerous permission translated into plain Portuguese — no technical jargon.
The hard way — and the CanalVIP way
Auditing an APK by hand takes tools, a terminal and experience. APK X-Ray does the same work with a single file drop.
Manual analysis
- ✕ Install Java, jadx, apktool and dependencies
- ✕ Decompile to smali / dex and page through the code
- ✕ Hunt URLs and secrets with grep by hand
- ✕ Inspect the certificate in the terminal (keytool)
- ✕ Cross-reference permissions with what each one means
With APK X-Ray
- ✓ Drag the .apk straight into the browser
- ✓ A–F risk verdict in seconds
- ✓ URLs, IPs, secrets and trackers already extracted
- ✓ Automatic detection of modified/recompiled APKs
- ✓ Every dangerous permission explained in Portuguese
Four steps, all in your browser
The file is opened in the browser's memory. Nothing is uploaded.
We unpack it, decode the binary manifest and scan the code (DEX) and resources.
Permissions, trackers, secrets and signature become a security score with reasons.
Free summary instantly; full report and JSON export on the VIP plan.
When APK X-Ray is worth its weight in gold
Find out whether an APK downloaded outside the Play Store is safe — before putting it on your device.
Discover whether an APK was recompiled, had its signature swapped or got code injected.
See which trackers the app carries and where it sends your data.
Lightning-fast audit of permissions, SDKs and leaked secrets before publishing.
Your APK never leaves your device
Unlike services that upload the file to a server, here all the reverse engineering runs in your browser. The APK is not uploaded, not stored and not shared. Serious analysis, with full privacy.
The summary is free. The full report is VIP.
You always see the verdict and the numbers. The VIP plan opens every detail — and unlocks all the other CanalVIP tools.
Frequently asked questions
Is my APK uploaded to any server?
No. All analysis happens inside your browser, in your own device's memory. The file is never uploaded, stored or shared.
Do I need to install anything?
Nothing. It works in any modern browser (phone or computer), with no app, no extension and no signup for the free summary.
What does "signed with a debug key" mean?
It's a strong sign that the APK was recompiled or modified — a mod, crack or tampered version. Official apps are signed with the developer's release key, never with Android's debug key.
Does it work with any APK?
Yes, with standard .apk files. On very large APKs, the code (DEX) is sampled to keep the analysis instant — the verdict and detection remain valid.
How accurate is the report?
We read the real binary manifest, the code (DEX) and the signing certificate — the same sources an analyst would use. Use it as a fast, reliable security and privacy triage, not as an official forensic report.
Ready for the X-ray?
Drag in an APK and get the security verdict in seconds. Free to start.