The private, in-browser
Android APK security suite.
Decode binary manifests, inspect Dalvik bytecode, hunt exposed secrets, map OWASP Mobile Top 10 vulnerabilities, and decompile Java/Kotlin source code—running completely in your local browser sandbox.
Drop your Android APK here or browse files
Zero bytes uploaded to external servers. Safe for proprietary, pre-release, and NDA builds.
8 In-Browser Static Inspection Engines
Hover over the revolving orbit or click any engine to inspect real-time static triage capabilities.
AXML Manifest Engine
Decodes binary compiled AndroidManifest.xml chunks, extracting permissions, exported components, and SDK limits.
APKLens vs Cloud Static Analyzers
Why security researchers and enterprises trust local in-browser inspection over legacy cloud services.
How APKLens Works
Three simple steps to comprehensive Android static triage without complex command line toolchains.
Drop & In-Memory Unpack
The browser reads your APK directly into local memory as an ArrayBuffer. ZIP headers are unpacked without saving bytes to disk or transmitting to a remote backend.
Automated Deep Triage
The binary AXML chunk parser decodes AndroidManifest.xml, maps Multi-DEX tables, extracts deep link schemes, and evaluates OWASP Mobile Top 10 compliance.
Audit, Decompile & Export
Inspect Java/Kotlin source with targeted JADX decompilation, test deep link intent filters with ADB PoCs, and export Bug Bounty Markdown, SARIF, or CSV.
No rate limits.
No subscriptions.
No cloud exposure.
Everything stays on your local machine. We don’t send your APK or findings anywhere, because there’s nowhere to send it. It all runs locally in your browser sandbox.
Jojin John
Software Engineer and Ethical Hacker passionate about Android OS internals, Dalvik DEX bytecode reverse engineering, binary instrumentation, and designing high-performance developer tooling with zero server-side data leakage.