Free tool · Android · iOS
Free APK and IPA security scanner, online.
Upload an Android .apk or iOS .ipa build and get a security report on the app itself: what it asks for, what it stores and what it gives away.
An APK security scanner analyses an Android app package (and, for iOS, an IPA) without running it, and reports security issues in the build: dangerous permissions, hard-coded API keys and secrets, cleartext traffic and weak TLS settings, weak cryptography, exported activities and services, and debug settings left on in a release build.
What the app scan checks
| Check | Example finding |
|---|---|
| Permissions | An app that asks for contacts and SMS it does not need |
| Hard-coded secrets | An API key or cloud credential inside the build |
| Network security | Cleartext HTTP allowed, or certificate validation disabled |
| Cryptography | MD5 or ECB mode used to protect data |
| Exported components | An activity other apps can open without permission |
| Debug settings | android:debuggable left on in a release build |
Frequently asked questions
Is an APK scan the same as mobile app penetration testing?
No. The scan analyses the build. A penetration test also tests the running app on a device and the APIs behind it, by hand.
Is my app build kept?
The build is used to produce your report. See the privacy policy for how scan data is handled.
Can I scan an iOS app?
Yes. Upload the .ipa build in the same box.
More free tools
Shipping an app to a bank or healthcare client?
Sumrite tests Android and iOS apps against OWASP MASVS, with a retest.