In August 2021, Google made a decision that fundamentally changed how Android apps are distributed: all new apps submitted to the Google Play Store must use the Android App Bundle (AAB) format instead of the traditional APK. This shift affected developers, users, and the entire ecosystem of third-party app distribution. But what exactly is an App Bundle, how does it work, and why should you care?

This guide covers everything from the technical internals of the AAB format to the practical implications for users who want to share apps with friends or install them on devices without Play Store access.

What is an Android App Bundle?

An Android App Bundle is a publishing format that contains all of an app's compiled code and resources but defers the generation of the final installable APK to Google Play. Think of it as a master template from which Google's servers create optimized, device-specific packages on the fly.

Unlike an APK, which is a ready-to-install package, an AAB file cannot be directly installed on a device. It is a build artifact that gets uploaded to the Play Store, where Google's infrastructure processes it and generates tailored APKs for each device configuration.

The file extension is .aab, and internally it uses a protocol buffer format combined with a ZIP-like structure. It contains the app's DEX bytecode, resources, assets, native libraries, and a special bundle metadata file that tells Google Play how to split the content.

Why Google Mandated App Bundles

The primary motivation behind App Bundles is reducing app download sizes. A typical Android app needs to support multiple screen densities (mdpi, hdpi, xhdpi, xxhdpi, xxxhdpi), multiple CPU architectures (armeabi-v7a, arm64-v8a, x86, x86_64), and multiple languages. In the traditional APK model, all of these resources are bundled into a single file, even though any given device only needs a fraction of them.

Consider a game that includes native libraries for four CPU architectures and textures for five screen densities. The universal APK might be 200 MB, but a device-specific version containing only the relevant architecture and density could be 80 MB. That is a 60% reduction in download size.

Google reports that apps using App Bundles are on average 15% smaller than their universal APK equivalents. For large apps and games, the savings can be much more dramatic. Smaller downloads mean faster installs, less bandwidth consumption, and fewer abandoned installations due to size concerns.

How App Bundles Work Internally

The Bundle Structure

An AAB file is organized into modules, with each module containing its own code, resources, and assets. The most common structure includes:

• Base module: Contains the core app code and resources that every device needs. This is always installed.
• Configuration splits: Separate sections for language resources, screen density resources, and ABI (CPU architecture) native libraries.
• Dynamic feature modules: Optional modules that can be downloaded on demand after the initial installation.
• Asset packs: Large assets like game levels or media that can be delivered at install time, on demand, or in the background.

Split APK Generation

When a user downloads an app from the Play Store, Google's servers examine the device's configuration and generate a set of split APKs tailored to that specific device. A typical installation might include:

• base.apk, The core application code and essential resources
• split_config.arm64_v8a.apk, Native libraries for the device's CPU
• split_config.xxhdpi.apk, Resources for the device's screen density
• split_config.en.apk, Language resources for the user's locale

These split APKs are installed together as a single logical app. The Android package manager treats them as one application, but they are physically separate files on the device. This is the mechanism that enables the size savings.

Dynamic Delivery

One of the most powerful features of App Bundles is dynamic delivery. Developers can mark certain features as downloadable on demand. For example, a photo editing app might include advanced filters as a dynamic feature module. Users who never use those filters never download them, saving storage space.

Dynamic feature modules are downloaded and installed through the Play Core library at runtime. The app can check whether a module is installed and request its download when needed, so the user experiences the new functionality as a small in-app download rather than a full reinstall.

AAB vs APK: Key Differences

Understanding the differences between these formats helps clarify when each is appropriate:

• Installability: APK files can be directly installed on any Android device. AAB files cannot be installed directly and must be processed first.
• Size: A universal APK contains resources for all configurations. An AAB enables device-specific delivery, resulting in smaller downloads.
• Signing: With APKs, the developer signs the final installable package. With AABs, the developer signs the bundle, and Google re-signs the generated APKs using Play App Signing.
• Distribution: APKs can be distributed through any channel. AABs are primarily designed for the Play Store, though tools like bundletool can generate APKs from them locally.
• Shareability: You can easily share an APK file with another person. Sharing an app installed from an AAB requires collecting all the split APKs, which is more complex.

The Signing Controversy

One of the most debated aspects of the AAB mandate is Play App Signing. When a developer uploads an AAB, Google holds the signing key used to sign the final APKs delivered to users. This means Google technically has the ability to modify the APK content before signing and delivering it.

Google argues this is necessary because they need to sign the split APKs they generate. Developers retain an upload key to authenticate their uploads, but the actual app signing key is managed by Google's infrastructure.

For most developers, this is a reasonable trade-off. Google provides key backup and recovery services, and the risk of key loss (which would permanently prevent app updates) is eliminated. However, privacy-focused developers and open-source advocates have raised concerns about this centralization of trust.

What This Means for Users Who Share Apps

The shift to App Bundles has significant implications for users who want to share apps outside of the Play Store:

Extracting Installed Apps

When you extract an app installed from an AAB, you do not get a single APK file. Instead, you get a collection of split APKs. These splits are device-specific, meaning an app extracted from a phone with an ARM64 processor and xxhdpi screen will not work on a device with a different configuration.

XAPK and APKS Formats

To address the challenge of sharing split APKs, container formats like XAPK and APKS were created. These formats bundle all the split APKs together into a single downloadable file. When you encounter an XAPK file, it likely contains an app that was originally distributed as an App Bundle.

Our XAPK to APK converter can help you extract the base APK from these container formats. However, keep in mind that the base APK alone may not contain all the resources needed for the app to function correctly on every device, since density and ABI-specific resources might be in the split APKs.XAPK to APK converter

Using bundletool

Google provides an open-source tool called bundletool that can generate APKs from an AAB file locally. Developers can use this to create universal APKs for testing or alternative distribution. The command looks like:

bundletool build-apks --bundle=app.aab --output=app.apks --mode=universal

This generates a universal APK that contains all resources for all configurations. It will be larger than a device-specific build but works on any device. This is the approach used by our AAB to APK converter.AAB to APK converter

Impact on Alternative App Stores

The AAB mandate primarily affects the Google Play Store. Alternative app stores and direct distribution channels can still accept APK files. Developers who want to distribute outside of Play can continue building universal APKs alongside their AAB uploads.

However, some developers only build AABs and rely entirely on Play for distribution. This means that apps from these developers are harder to obtain outside of the Play Store ecosystem. Third-party app repositories have adapted by either hosting the split APK collections (as XAPK or APKS files) or by using bundletool to generate universal APKs.

Dynamic Feature Modules in Practice

Dynamic feature modules represent one of the most interesting capabilities of the App Bundle format. Here are some real-world use cases:

• Camera features: An app might include AR filters as a dynamic module, downloaded only when the user first accesses the camera feature.
• Language packs: Translation data for less common languages can be delivered on demand rather than bundled with every installation.
• Game levels: Games can deliver additional content as players progress, keeping the initial download small.
• Professional tools: Advanced features in productivity apps can be delivered only to users who need them.

For users, this means that an app's installed size might grow over time as dynamic modules are downloaded. It also means that sharing such an app requires including all downloaded modules, further complicating the extraction process.

Best Practices for Developers

If you are developing Android apps, here are recommendations for working with App Bundles effectively:

1. Always test with bundletool locally before uploading to Play. Generate device-specific APKs and verify they work correctly.
2. Use the Play Console's internal testing track to verify that split APKs install and function correctly on real devices.
3. Consider providing a universal APK for alternative distribution channels if your user base extends beyond the Play Store.
4. Be mindful of dynamic feature module boundaries. Features that are frequently used should be in the base module, not dynamic modules.
5. Test on devices with different configurations to ensure that configuration splits are generated correctly and no resources are missing.
6. Keep your upload key secure. While Google manages the app signing key, your upload key authenticates your identity as the developer.

The Future of App Distribution

The App Bundle format continues to evolve. Google has introduced features like Play Asset Delivery for large game assets, SDK Runtime for advertising SDKs, and improved support for Wear OS and Android TV configurations. The trend is toward more granular, on-demand delivery of app components.

For users, this means that the concept of a single, self-contained app file is becoming less common for Play Store apps. Understanding formats like XAPK, APKS, and the tools available to work with them becomes increasingly important for anyone who manages apps outside of the standard Play Store flow.

When to Keep an AAB vs. When to Build a Universal APK

The Android App Bundle represents a fundamental shift in how apps are packaged and delivered. While it brings genuine benefits in terms of download size and delivery efficiency, it also introduces complexity for users who share apps or install them from alternative sources. Understanding how AABs work, how they generate split APKs, and what tools are available to convert between formats gives you what you need to pick the right format and convert between them with confidence.

Developers reach for AAB to optimize how an app is delivered; most everyday users only meet it when they try to install something on a device with no Play Store access. Either way, the thing worth remembering is simple: AAB is a publishing format, not an installation format, and there are tools that bridge the gap between the two.

A Practical Guide to Android App Icons: Adaptive Icons Explained (and How to Generate Yours Correctly)

It's a common surprise for first-time Android developers: you polish a single square PNG for your app icon, export it at a tidy 512x512, and it looks perfect in your image editor. Then you install a debug build on a Samsung phone and the icon suddenly looks cropped and slightly off-center, as if part of the logo has been chopped away. Nothing is wrong with the file itself. The problem is that a single square image was never going to survive contact with the real world of Android launchers, each of which crops, masks, and reshapes icons differently. If you haven't run into this yet, it's only a matter of time before you do, so let's go through what's happening under the hood and how to get it right the first time.

Why a Single Square PNG Isn't Enough Anymore

In the earliest years of Android, app icons were exactly what they looked like: a single square (or occasionally free-shaped) PNG that every launcher displayed as-is. That worked fine until manufacturers started differentiating their phones visually, and one of the easiest places to do that was the home screen. Samsung wanted rounded squares, some Chinese OEM skins wanted different corner treatments, and stock Android eventually settled on circles. Suddenly, the exact same icon file looked noticeably different, and sometimes visibly worse, depending on whose phone it landed on.

Google's answer, introduced with Android 8.0 Oreo, was the adaptive icon system. Instead of supplying one fixed shape, developers provide layered artwork that the operating system itself masks into whatever shape a given launcher prefers. The visual identity stays consistent; only the outer silhouette changes.

What Exactly Is an Adaptive Icon?

An adaptive icon is built from two separate layers, each occupying a 108dp by 108dp canvas: a background layer and a foreground layer. Android composites the two together and then applies whatever mask shape the current launcher uses, whether that's a circle, a rounded square, a teardrop, or something else entirely. The two-layer structure is what allows Android to add subtle parallax and motion effects too, since the layers can shift independently when you tap or drag an icon.

In an app's resources, this is usually defined through an XML file like mipmap-anydpi-v26/ic_launcher.xml, which simply points to the background and foreground drawables rather than containing pixel data itself. A traditional flat ic_launcher.png is still kept around as a fallback for devices running Android 7.1 or earlier, which predate the adaptive icon system entirely.

Why the Safe Zone Matters

Here's the part that trips people up the most. Even though the canvas for each layer is 108dp by 108dp, only the inner 66dp by 66dp circle, centered in that canvas, is guaranteed to be visible regardless of which mask shape gets applied. This inner region is commonly called the safe zone. Anything outside it might get shown on a circular mask and then abruptly clipped on a more aggressive squircle or teardrop mask, or vice versa.

This is exactly the kind of issue that shows up when a logo is drawn close to the edges of the canvas to maximize its visual size: it can look perfect on a circular mask but get clipped unevenly on Samsung's squircle mask. The fix isn't a redesign, just shrinking the artwork slightly so the meaningful content stays inside the safe zone no matter which shape ultimately gets applied.

Launcher Shapes You'll Encounter

The practical takeaway is that you don't get to choose which of these shapes your icon ends up wearing. Users on stock Android launchers can often even pick their preferred shape from a settings menu. Your only real lever is making sure the artwork itself survives all of them gracefully, which is exactly what the safe zone is there to guarantee.

Building the Assets: Sizes and Densities You Need

If you're also shipping the app on iOS, add another set entirely, since Apple's App Store icon requirements top out at 1024x1024 and use a completely different, non-layered format with no transparency at all.

The Manual Way vs Using a Generator

You can absolutely produce every one of these sizes by hand in an image editor, or through Android Studio's built-in Image Asset Studio, which handles the density scaling and mask previews reasonably well for a single project. Where this gets tedious is when you're maintaining a design system across several apps, need matching iOS exports from the same master artwork, or simply want a quick way to double-check how a design behaves across every shape before committing to it.

Extracting Icons From an Existing APK

Sometimes the need runs in the opposite direction. Maybe you inherited a project without its original design files, or you want to see exactly how a competitor structured their icon before designing your own, or you simply need to pull an icon back out of a built APK to reuse it in a related tool or marketing asset. Since an APK is effectively a structured archive containing all of an app's resources, its launcher icon files are physically present inside it and can be extracted directly, rather than reconstructed from scratch.

Our Icon Extractor pulls exactly these files out of any APK you upload, giving you the raw icon assets at whatever resolution the original developer shipped, which is often the fastest way to recover a lost source file or study how another app approached the same design problem.Icon Extractor

Common Icon Mistakes That Get Flagged in Review

• Baking in extra padding or UI chrome. A drop shadow, border, or rounded-corner effect added manually inside the image conflicts with the system's own masking and often looks doubled-up or misaligned.
• Using a pure white background with no distinct edge. On light-themed launchers, the icon can become nearly invisible against the home screen background.
• Overly fine detail. Text and intricate linework that look sharp at 512px frequently turn into an unreadable smudge once scaled down to 48px, which is how most users see it day to day.
• A mismatch between the Play Store listing icon and the icon that installs. Reviewers and users both notice when these two don't match, and it reads as sloppy or, worse, suspicious.
• Forgetting the legacy fallback entirely. If your app still supports Android versions before 8.0, skipping the flat PNG fallback can leave those users with a broken or generic-looking icon.

Testing Your Icon Across Shapes Before You Ship

Before finalizing an icon, it's worth previewing it under at least a circular mask and a squircle mask side by side, rather than assuming it will translate cleanly. Android Studio's Image Asset Studio includes a live preview across several launcher shapes for exactly this reason, and it takes only a minute to catch an issue that would otherwise only surface after publishing, when a user on the "wrong" launcher shape reports back that something looks off.

Frequently Asked Questions

You don't need a background in design theory for any of this, just an awareness that your icon will be reshaped in ways you don't control the moment it leaves your hands. Design for the safe zone, keep a legacy fallback around, generate every required size from one clean master file, and your icon will hold up no matter which launcher it lands on.

Android App Signing: How it Works and Why it Matters

Every time you install an app on your Android phone, a silent but critical security check happens in the background. Your phone verifies the digital signature of the APK package. This cryptographic handshake is what prevents malicious hackers from "poisoning" your apps with malware while ensuring developers can push updates without losing their identity.

If you write apps, signing is something you simply have to get right; if you just like to tinker with Android, it is one of the most satisfying parts of the system to understand. Either way, how app signing works is worth your time. Below we walk through the technology, how the signing schemes evolved, and how you can manually verify certificates online.manually verify certificates

What is App Signing?

At its core, app signing is a process where a developer uses a Private Key to generate a signature block for their app's files. The corresponding Public Key is then embedded in the APK within the META-INF folder. When your phone tries to install the app, it uses the public key to check if the signature matches the content of the file.

This provides two main properties:

1. Immutability: If a single byte of the app's code is changed (e.g., by a Trojan), the signature will no longer match the file, and Android will refuse to install it.
2. Proof of Identity: If an app tries to update an existing one, their signatures must match. This is why you can't install a tampered Facebook app over the official one.

Evolution of Signing Schemes

Google has continuously upgraded the signing mechanism to improve both speed and security:

• V1 (Jar Signing): Signs individual files within the APK (ZIP). This is slow because the OS has to unzip and check every file. It's also vulnerable to certain ZIP manipulations.
• V2 (APK Signature Scheme): Signs the entire binary block of the APK. It doesn't require unzipping to verify, making it incredibly fast. It was introduced in Android 7.0 (Nougat).
• V3 (Key Rotation): Extends V2 by adding a "lineage" of keys. It allows a developer to prove that a new key is the authorized successor to an older one. Introduced in Android 9.0 (Pie).
• V4 (Streaming signing): Designed specifically for incremental installations, allowing apps to be verified while they are still being downloaded over USB or Wi-Fi.

Why Certificates Matter for Sideloading

When you download an APK from an unofficial source, the Certificate Hashing is your best friend. A certificate fingerprint (such as a SHA-256 hash) uniquely identifies the developer's signing key. Each app keeps the same signing key across all of its updates, so you can compare an APK's fingerprint against the developer's published value to confirm it is genuine.

If you suspect an APK is fake, you should run it through our Online APK Verifier. Our tool will show you:Online APK Verifier

• The Common Name (CN) of the signer (e.g., "Android").
• The Validity Period of the certificate.
• The SHA-1/SHA-256 fingerprints.

How Android Verifies a Signature at Install Time

The "verify the certificate" step is so often glossed over that it's worth walking through what the OS actually does when you tap an APK and Android decides whether to install it:

1. Open the APK as a ZIP and locate the signing block. For v2/v3 signatures that is a structured block immediately before the central directory; for the legacy v1 scheme it is the contents of META-INF/*.RSA, *.DSA, or *.EC.
2. Compute SHA-256 digests of every other byte of the APK. The signing block is excluded from its own digest; everything else is hashed in defined chunks.
3. Verify each chunk's digest against the digests recorded in the signing block. If even a single byte has been altered since the developer signed the file, the digests will not match and the install is rejected with a generic "App not installed" error.
4. Verify the signing block itself was produced with the certificate's private key. The certificate's public key is used to check the cryptographic signature in the block. A successful check means whoever signed the file possessed the private key paired with this certificate.
5. Compare the certificate fingerprint with any existing install of the same package name. If the package is already installed and the new APK is signed with a different certificate, the install is rejected with INSTALL_FAILED_UPDATE_INCOMPATIBLE. This is the OS's main anti-impersonation defence: a malicious actor cannot replace your bank app with their own copy unless they also stole the bank's signing key.

None of this proves the developer is trustworthy, only that the file you are about to install is byte-identical to what they signed and that no other party has tampered with it. Trust in the developer is a separate decision, and one you make by deciding which sources you install from.

What "Signature Mismatch" Really Means

The single most common surprise people hit when sideloading is the "signature mismatch" error on update. Here is what is actually happening:

• You have App X version 1.0 installed from the Play Store.
• You download App X version 1.1 from a non-Play source.
• The OS sees the same package name (com.example.app) but the APK is signed with a different certificate (the side-source's signing key, not the original publisher's). It refuses to install.

Two ways this happens in practice:

1. The third-party APK is genuinely from a different publisher, for example a "modded" or "patched" copy. Refusing the install is the correct behaviour; installing it would mean trusting a stranger with the same data your bank's app already touched.
2. The third-party APK is a re-upload of the official APK, but Google's Play App Signing system signs each user's download with the user's upload key wrapper. Two devices can sometimes see slightly different signature data for the same conceptual app version. In that case the certificate fingerprint at the root still matches; you can verify with our APK Verifier.APK Verifier

If the certificate fingerprint truly differs from your existing install, the only way forward is to uninstall the current copy first (losing its data) before sideloading the replacement, never to disable signature verification.

Generating Your Own Signing Key (For Developers)

If you are building Android apps, you will eventually need to sign your own builds. The standard one-line command using keytool from a Java SDK is:

keytool -genkeypair -v \
        -keystore my-release.keystore \
        -alias my-app -keyalg RSA -keysize 2048 \
        -validity 10000

Two things to know:

• The validity matters: 10000 days (roughly 27 years) is the conventional value because the OS treats updates signed with a near-expired or expired key as compromised. Generate a long-lived key once and protect it.
• Once published, you cannot easily switch keys. The v3 signing scheme adds key rotation as an explicit feature: an old certificate "blesses" a new one through a stored proof, allowing the OS to accept updates from the new key while preserving the identity continuity. Without v3, losing the original key means orphaning all existing installs.

For sideloaded test builds, an unsigned debug keystore is fine; for production, use a password-protected long-validity keystore stored in offline backup.

Common Signing Pitfalls

1. Self-Signed Certificates: Most Android apps are self-signed. Unlike SSL for websites, there is no central authority for Android app signing. You must trust the developer directly.
2. Debug Certificates: Apps built for testing use a generic "debug" key. These apps should never be released to the public and are blocked by many security filters.
3. Key Loss: If a developer loses their private keystore, they can never update their app again. They would have to release a "New" app with a different package name.

Choosing the Right Signing Scheme for Your Target SDK

App signing quietly underpins a lot of Android's security. Once the private/public key relationship clicks, you can judge a sideloaded app on its merits and confirm that what you are installing has not been altered since the developer signed it. For more on Android internals, see our guide to the XAPK format.guide to the XAPK format

Understanding Android CPU Architecture (ABI): Why arm64-v8a, armeabi-v7a, and x86 Matter

If you've ever merged a set of split APK files and watched your phone throw back "App not installed," or worse, watched it install fine only to crash the instant you tapped the icon, there's a decent chance the real problem had nothing to do with a corrupted download. It was almost certainly about architecture: a mismatch between the CPU your phone runs on and the CPU the app's native code was compiled for. Most Android users never have to think about this, right up until the moment it quietly breaks something, and then it becomes relevant fast. Here's what CPU architecture means for an APK, why a single app on the Play Store secretly ships as several different builds of itself, and how to check compatibility before you install anything.

What an ABI Is

ABI stands for Application Binary Interface. In practical terms, it's the instruction set a chip understands — the raw machine code format a processor can execute directly. Most of an Android app, the parts written in Java or Kotlin, gets compiled into bytecode that runs inside the Android Runtime (ART), and ART doesn't particularly care which chip it happens to be sitting on. That layer is architecture-agnostic by design, which is a big part of why Android apps generally "just work" across such a wide range of hardware.

Native code is a different story. Plenty of apps, especially games, camera apps, machine-learning tools, and anything doing heavy audio or video processing, ship native libraries written in C or C++ through the Android NDK. Those libraries are compiled ahead of time into machine code for one specific instruction set, and a chip built for one instruction set generally can't execute machine code written for a different one. That's the entire reason ABIs exist as something worth understanding: the moment an app includes even one native .so library, its compatibility becomes tied to the architectures that library was built for.

The Architectures You'll Run Into

There used to be more variety in this space (remember plain armeabi, or MIPS?), but by 2026 the field has narrowed down to four ABIs worth knowing:

If you're holding a phone bought any time in the last five or six years, it's almost certainly arm64-v8a. The exceptions worth remembering are emulators and Chromebooks, which frequently run on x86_64 instead, since that matches the underlying laptop or desktop CPU.

Why Apps Bother Shipping Multiple Builds At All

One obvious question is why developers don't just cram every architecture's native libraries into a single APK and be done with it. Some apps do exactly that, and it's called a universal or "fat" APK. The downside is size. A game with native libraries for arm64-v8a, armeabi-v7a, x86, and x86_64 all bundled together can easily double or triple in size compared to a build containing just the one architecture your device needs. Multiply that across millions of installs and you're looking at a genuinely significant amount of wasted bandwidth and storage, for code that will never run on that device.

To avoid that waste, Google Play and the Android App Bundle format split an app into a small base APK plus a series of configuration APKs, one of which is dedicated to architecture. When your phone requests the app, Play Store delivers the base APK together with only the architecture split that matches your chip, along with matching screen-density and language splits. You end up with an install that behaves like a single app but is assembled from several purpose-built pieces behind the scenes.

How Split APKs and App Bundles Use This

If you've ever opened an .apks or .xapk package and noticed filenames like split_config.arm64_v8a.apk, split_config.armeabi_v7a.apk, split_config.xxhdpi.apk, and split_config.en.apk sitting next to a base.apk, that's exactly this system in action, just exported as a set of files instead of being delivered silently by the Play Store. Density and language splits are usually safe to install indiscriminately since a phone will simply ignore resources it doesn't need. The architecture split is different: install the wrong one, or fail to install the matching one, and you'll run into real trouble.

When you use a converter to merge a split package back into a single installable APK, the merge process has to pick which architecture splits to fold in. A good converter keeps every architecture split that's genuinely useful, or lets you choose, rather than silently keeping only one and hoping it matches your device.

What Happens When the Architecture Doesn't Match

There are two distinct failure modes worth knowing apart, because they look and feel different to a regular user.

The first is an outright install failure. If an app is built almost entirely around native code with no meaningful fallback, Android's package manager will refuse to install it at all, usually surfacing an error like INSTALL_FAILED_NO_MATCHING_ABIS. You'll never even get to open the app; the installer stops you at the door.

The second, more frustrating outcome is a silent partial success. If an app has a Java or Kotlin entry point that loads fine on its own, but then tries to call into a native library that simply isn't present for your architecture, the install completes normally. Everything looks fine until you tap the icon, at which point the app crashes almost immediately, often with an UnsatisfiedLinkError buried in the logs. This is the classic "I converted it, it installed, then it just closes instantly" story, and it's almost always an architecture problem rather than a corrupted file.

How to Check Your Own Phone's Architecture

For the vast majority of people this is simple: if your phone is from 2019 or later, assume arm64-v8a and move on. If you want to be certain, or you're dealing with an older or unusual device, a few practical options:

• Look up your phone's exact chipset model (visible on the box, in the manual, or on a site like GSMArena) and search whether that chipset is 32-bit or 64-bit ARM.
• Install a lightweight system-information app that reports CPU architecture directly, several free ones exist specifically for this purpose.
• Check whether the phone shipped with Android 9 or later as its original OS version; Google's 64-bit requirements from around that era make arm64-v8a essentially guaranteed on anything that qualifies.

How to Check What Architectures an APK Supports

Before installing a file from outside the Play Store, it's worth confirming what's inside it rather than guessing. An APK's native libraries live in folders named after their architecture inside the lib/ directory, such as lib/arm64-v8a/ or lib/armeabi-v7a/. Any tool that can inspect an APK's internal structure can tell you exactly which of these folders are present, which tells you exactly which devices the file will run on.

Universal APK vs Single-ABI APK: Which Should You Use?

Common Mistakes People Make With Split Packages

• Assuming every split is optional. Density and language splits usually are, but the architecture split is not; never skip it during a merge.
• Grabbing only one architecture split from a mirror site. If a third-party download only offers, say, the armeabi-v7a slice, it may simply fail on a device that needs arm64-v8a instead, even though the app itself is legitimate.
• Forgetting that tablets and Chromebooks aren't always ARM. Plenty of Chromebooks running Android apps, and some older tablets, are x86 or x86_64 rather than ARM.
• Testing an ARM-only APK inside an x86 emulator. Some older emulator builds run on x86, and an APK that only ships ARM native libraries simply won't launch inside them, regardless of how the APK was packaged.
• Confusing "universal" with "single-ABI." A universal APK is intentionally larger because it includes everything; a single-ABI APK is small and intentionally limited to one chip family.

Frequently Asked Questions

You don't need to memorize any of this. The short version: modern phones are almost always arm64-v8a, apps get split by architecture to save space, and if something refuses to install or crashes right after opening, architecture mismatch is one of the first things worth ruling out before assuming the file itself is broken.

The Android ecosystem uses a variety of file formats for packaging, distributing, and storing app data. If you have ever downloaded an app from a third-party source, you have likely encountered file extensions beyond the familiar APK. Formats like XAPK, APKS, APKM, AAB, and OBB each serve a specific purpose in the Android app lifecycle.

This guide is meant to be a complete reference for every major Android file format. Developers, power users who sideload apps, and curious readers who just want to know what these files actually contain will all find each format explained in plain language below.

APK: Android Package Kit

The APK is the foundational file format for Android applications. It has been the standard installation format since Android's inception and remains the format that the Android operating system natively understands for app installation.

What It Contains

An APK file is essentially a ZIP archive with a specific internal structure:

• AndroidManifest.xml, Binary XML file declaring the app's package name, components, permissions, and requirements
• classes.dex (and classes2.dex, etc.), Compiled Dalvik bytecode containing the app's Java/Kotlin code
• resources.arsc, Compiled resource table mapping resource IDs to their values
• res/, Directory containing resources like layouts, drawables, and strings that are referenced by ID
• assets/, Raw asset files accessed by the app at runtime through the AssetManager
• lib/, Native libraries organized by CPU architecture (e.g., lib/arm64-v8a/)
• META-INF/, Signature files and certificate information

When You Encounter It

APK files are what you download when sideloading apps from third-party sources. They are also what gets installed on your device from the Play Store, though modern Play Store installations often use split APKs generated from App Bundles.

How to Handle It

APK files can be directly installed on Android by opening them with a file manager or using adb install. You can also examine their contents by renaming the extension to .zip and extracting, or by using our APK Verifier to inspect signatures and metadata.APK Verifier

AAB: Android App Bundle

The Android App Bundle is Google's publishing format for the Play Store. Since August 2021, all new apps on the Play Store must be submitted as AABs rather than APKs.

What It Contains

An AAB file uses a protocol buffer-based format and contains:

• Base module: Core app code and resources required on every device
• Configuration splits: Resources organized by screen density, CPU architecture, and language
• Dynamic feature modules: Optional features that can be downloaded on demand
• Bundle metadata: Instructions for Google Play on how to generate device-specific APKs

When You Encounter It

As a regular user, you typically do not encounter AAB files directly. They are used by developers during the build and upload process. However, if you obtain an AAB file (perhaps from an open-source project's build artifacts), you need to convert it to APK format before installation.

How to Handle It

Use Google's bundletool command-line utility or our AAB to APK converter to generate an installable APK from an AAB file. The conversion process creates either a universal APK (larger, works everywhere) or device-specific APKs (smaller, device-targeted).AAB to APK converter

XAPK: Extended APK

XAPK is a container format popularized by APKPure that bundles an APK together with its associated OBB data files or split APK configurations into a single downloadable package.

What It Contains

An XAPK file is a ZIP archive containing:

• A base APK file (the main application)
• OBB files (expansion data for games and large apps)
• Optionally, split APK files for different device configurations
• A manifest.json file describing the package contents and installation instructions
• An icon file for display purposes

When You Encounter It

You encounter XAPK files when downloading large apps or games from third-party app repositories. Games that require additional data files (previously distributed as OBB files) are commonly packaged as XAPKs to simplify the download process into a single file.

How to Handle It

XAPK files cannot be directly installed by Android's default package installer. You need either a dedicated XAPK installer app or you can use our XAPK to APK converter to extract the base APK. For games that require OBB data, you will also need to extract and place the OBB files in the correct directory using our OBB Extractor.XAPK to APK converterOBB Extractor

APKS: APK Set

The APKS format is the output of Google's bundletool when generating device-specific APKs from an AAB file. It is also used by some app backup tools to store split APK installations.

What It Contains

An APKS file is a ZIP archive containing:

• toc.pb, A protocol buffer table of contents describing the split structure
• splits/, Directory containing the base APK and all configuration split APKs
• Optionally, standalone APKs for devices that do not support split installations

When You Encounter It

You encounter APKS files when using bundletool locally, when backing up apps installed from the Play Store, or when downloading from certain third-party repositories that preserve the split APK structure.

How to Handle It

You can install APKS files using bundletool's install-apks command or convert them to a single APK using our APKS to APK merger. Note that merging split APKs into a universal APK may increase the file size since all configuration resources are combined.APKS to APK merger

APKM: APKMirror Package

APKM is a proprietary container format created by APKMirror for distributing apps that consist of multiple split APKs. It serves a similar purpose to XAPK and APKS but uses APKMirror's own structure.

What It Contains

An APKM file is a ZIP archive containing:

• A base APK file
• Split APK files for various configurations (density, ABI, language)
• A metadata file describing the package structure

When You Encounter It

You encounter APKM files exclusively when downloading from APKMirror. The site uses this format for apps that are distributed as App Bundles on the Play Store and therefore consist of multiple split APKs.

How to Handle It

APKM files require the APKMirror Installer app for direct installation, or you can extract the contents (since it is a ZIP file) and install the split APKs manually using ADB's install-multiple command. The base APK can also be extracted and installed standalone, though some functionality may be limited without the configuration splits.

OBB: Opaque Binary Blob

OBB files are expansion files used by Android apps (primarily games) to store large amounts of data that exceed the Play Store's APK size limit. Although Google has largely replaced this system with Play Asset Delivery, many existing apps still use OBB files.

What It Contains

OBB files can contain any type of data the app needs:

• Game textures and 3D models
• Audio files and soundtracks
• Video content
• Level data and maps
• Any large binary data the developer chooses to store externally

The format of the data within an OBB file is entirely up to the developer. Some use ZIP compression, others use custom binary formats. The "Opaque" in the name reflects that Android treats the file as a black box.

When You Encounter It

OBB files are encountered when sideloading large games or when they are bundled within XAPK packages. They are stored at /Android/obb/[package.name]/ on the device's shared storage.

How to Handle It

OBB files must be placed in the correct directory for the app to find them. The filename typically follows the pattern main.[version].[package.name].obb or patch.[version].[package.name].obb. Use our OBB Extractor to extract OBB files from XAPK packages.OBB Extractor

DEX: Dalvik Executable

DEX files contain the compiled bytecode that runs on Android's runtime environment. They are found inside APK files but can also exist independently during development and debugging.

What It Contains

A DEX file contains:

• Compiled Java/Kotlin bytecode in Dalvik instruction format
• String constants and type definitions
• Method and field references
• Class definitions and their hierarchies

Technical Details

A single DEX file has a 65,536 method reference limit (the "64K limit"). Apps that exceed this limit use multiple DEX files (classes.dex, classes2.dex, etc.), a technique called multidex. Modern build tools handle this automatically.

ODEX, VDEX, and ART Files

These are optimized versions of DEX files created by the Android Runtime during or after installation:

• ODEX (Optimized DEX): Contains ahead-of-time compiled native machine code for frequently used methods. Generated during idle maintenance based on usage profiles.
• VDEX (Verified DEX): Contains the verified DEX bytecode with pre-computed verification results. This speeds up subsequent boots and app launches by skipping re-verification.
• ART (Android Runtime Image): Contains pre-initialized class objects and heap data. This allows the runtime to skip class loading and initialization for common framework classes during startup.

These files are system-generated and not something users typically interact with directly. They are stored in /data/dalvik-cache/ or alongside the APK in /data/app/.

SO: Shared Object (Native Libraries)

Files with the .so extension are native shared libraries compiled for specific CPU architectures. They contain machine code written in C, C++, or Rust that runs directly on the processor without the overhead of the Dalvik/ART runtime.

Architecture Variants

• armeabi-v7a, 32-bit ARM (most older devices)
• arm64-v8a, 64-bit ARM (most modern phones)
• x86, 32-bit Intel/AMD (some tablets and emulators)
• x86_64, 64-bit Intel/AMD (Chromebooks and emulators)

When an APK contains native libraries, it must include the correct architecture for the target device. If the wrong architecture is included, the app will crash with an UnsatisfiedLinkError.

XML Files in Android

Android uses XML extensively, but in two different forms:

Binary XML

Inside APK files, XML resources (layouts, manifests, string files) are stored in a compiled binary format called AXML. This format is more compact and faster to parse than text XML. Tools like aapt2 or apktool can decompile binary XML back to readable text.

Text XML

During development, XML files are in standard text format. The build process compiles them to binary XML for inclusion in the APK. Configuration files like network_security_config.xml and resource files in the res/ directory start as text XML.

ProGuard/R8 Mapping Files

While not an Android-specific format, mapping files (mapping.txt) are important for understanding obfuscated apps. When developers use code shrinking tools like R8, class and method names are replaced with short, meaningless identifiers. The mapping file records the original-to-obfuscated name translations, essential for reading crash reports.

Android Backup Format (AB)

Files with the .ab extension are Android backup archives created by adb backup. They contain a tar archive (optionally compressed and encrypted) of an app's data directory. This format is being deprecated in favor of cloud-based backup solutions but is still used by some backup tools.

IMG and Partition Images

While not app-related, Android system images use several formats worth mentioning:

• system.img: The read-only system partition containing the Android framework and pre-installed apps
• boot.img: Contains the Linux kernel and initial ramdisk
• vendor.img: Hardware-specific drivers and firmware
• super.img: Dynamic partition container used in modern devices (Android 10+)

Format Comparison Table

Here is a quick reference comparing the main app distribution formats:

• APK: Single file, directly installable, universal (all configs included), larger size
• AAB: Publishing format, not directly installable, requires processing by Play Store
• XAPK: Container (APK + OBB/splits), requires installer or extraction, used by APKPure
• APKS: Container (split APKs), bundletool format, requires installer or merger
• APKM: Container (split APKs), APKMirror format, requires their installer

Choosing the Right Tool

Depending on which format you are working with, different tools are appropriate:

• Have an XAPK? Use our XAPK to APK converter to extract the installable APKXAPK to APK converter
• Have an AAB? Use our AAB to APK converter to generate a universal APKAAB to APK converter
• Have split APKs (APKS)? Use our APKS to APK merger to combine themAPKS to APK merger
• Need to verify an APK? Use our APK Verifier to check signaturesAPK Verifier
• Need OBB files from an XAPK? Use our OBB Extractor to unpack expansion filesOBB Extractor

Which Android Package Format Should You Use?

The Android ecosystem's variety of file formats reflects the platform's evolution from simple single-file APKs to sophisticated modular delivery systems. Each format exists to solve a specific problem: AABs reduce download sizes, XAPKs simplify distribution of multi-file apps, OBBs handle large game data, and split APKs enable device-specific optimization.

Once you understand these formats, you can handle any Android package you run into, whether you are sideloading apps, backing up your device, or developing your own applications. The key takeaway is that most of these formats are ultimately containers that hold APK files in various configurations, and with the right tools, you can always extract what you need.

Android App Permissions Explained

Every Android app asks for permissions to reach parts of your device, but the request screens rarely explain what those permissions really let an app do. The rundown below covers every major Android permission, points out the handful that actually affect your privacy, and gives you a few simple rules for deciding what to allow.

What Are Android Permissions?

Android permissions are a security mechanism that controls what an app can access on your device. When you install or run an app, it may request access to various hardware features (camera, microphone) or data (contacts, location). Understanding these permissions is crucial for maintaining your privacy and security.

Permission Categories

Android divides permissions into two main categories:

Normal Permissions (Automatically Granted)

These permissions don't pose a significant risk to user privacy and are granted automatically:

• INTERNET: Access to the internet, almost all apps need this
• VIBRATE: Control the device's vibration motor
• SET_WALLPAPER: Change the device wallpaper
• WAKE_LOCK: Prevent the device from sleeping
• ACCESS_NETWORK_STATE: Check network connectivity status
• BLUETOOTH: Connect to paired Bluetooth devices

Dangerous Permissions (Require User Approval)

These permissions involve user data or device features that could affect privacy:

When to Be Suspicious

You should question a permission request when it doesn't match the app's function:

• 🚩 A flashlight app requesting Contacts or SMS access
• 🚩 A calculator requesting Camera or Microphone access
• 🚩 A wallpaper app requesting Phone or Call Log access
• 🚩 A game requesting SMS permissions
• 🚩 Any app requesting ALL permissions at once

How to Check an APK's Permissions Before Installing

If you're sideloading an APK, you should check its permissions before installing:

1. Use our APK Info tool to extract the complete permission listAPK Info tool
2. Review each permission against the app's stated purpose
3. Compare permissions with the official app on Play Store
4. If something looks suspicious, don't install it

Special Permissions: The Ones That Don't Show Up at Install Time

Beyond "normal" and "dangerous" permissions, Android has a third tier called special or appops permissions. These are the most powerful capabilities on the platform, powerful enough that the OS forces a separate, deliberate trip into Settings to enable each one. They are also the ones most commonly abused by malware. If a sideloaded app asks for any of these, stop and ask why.

• Accessibility Service (BIND_ACCESSIBILITY_SERVICE): originally designed for screen readers and physical-disability assistance. An app with this permission can read everything on your screen, see what you type, and even tap buttons on your behalf. Grant only to apps where the function is obviously accessibility-related (TalkBack, password managers' auto-fill flows, screen-reading dictionary apps).
• Device Admin / Device Owner: lets an app lock the device, wipe data, change the password, and disable the camera. Almost no consumer app needs this. Enterprise mobile management (MDM) clients are a legitimate exception.
• Draw over other apps (SYSTEM_ALERT_WINDOW): allows an app to paint over anything else on screen. Used legitimately by chat-head bubbles and overlay translators; abused by tap-jacking malware that hides a "yes, drain my account" button under a fake "claim your prize" overlay.
• All Files Access (MANAGE_EXTERNAL_STORAGE): bypasses the scoped-storage protections on Android 11+ and lets the app see every file on shared storage. Most apps should use the standard photo / document pickers instead.
• Notification Listener: lets an app read every notification on the device. A great feature for productivity hub apps; a perfect tool for credential theft when abused (banking apps post one-time codes to the notification stream).
• Install unknown apps: turns the host app into a side-loader. Set this on your browser or file manager only when you actually need to install an APK from outside the Play Store, then turn it back off.

Permission Combinations to Watch For

Individual permissions tell only part of the story. The combinations are often more revealing than any single request:

• Accessibility + Notification Listener + SMS: this is the classic Android banking-trojan trio. The trojan reads on-screen content, intercepts the bank's one-time-password notification, and can also pull the OTP from the SMS itself if the user happens to receive it via text. No legitimate consumer app combines all three.
• Camera + Microphone + ALL_FILES_ACCESS + background location: adware-style surveillance app pretending to be a flashlight, calculator, or wallpaper. Reject and uninstall.
• SYSTEM_ALERT_WINDOW + BIND_DEVICE_ADMIN: ransomware-class behaviour. The app can paint a "your phone is locked, pay X" screen on top of the launcher and prevent the user from disabling it.
• Phone + Contacts + Call Log for an app that is not a dialler, contacts app, or call-recording tool: extreme caution. This combination has no legitimate use outside the very narrow set of apps Google itself ships in those categories.

A Worked Audit Example

Suppose you found a free "torch" APK on a forum and ran it through our APK Info tool before installing. The manifest shows the following requested permissions:APK Info tool

android.permission.CAMERA
android.permission.FLASHLIGHT
android.permission.INTERNET
android.permission.READ_CONTACTS
android.permission.READ_SMS
android.permission.RECEIVE_SMS
android.permission.READ_PHONE_STATE
android.permission.ACCESS_FINE_LOCATION
android.permission.SYSTEM_ALERT_WINDOW

A torch app needs at most the camera permission (to access the LED through the camera subsystem), the flashlight permission, and possibly the internet permission for ads. Everything below that line is unjustified. READ_SMS + READ_CONTACTS + RECEIVE_SMS + location + draw-over-apps is the surveillance and OTP-theft signature described above. Decision: do not install. Delete the file.

Run the same kind of check on every APK you sideload. Five minutes with a permission auditor saves you from problems that no antivirus app can clean up after the fact.

How Permissions Behave on Different Android Versions

Permission UX has been reshaped almost every year. The same underlying capability can feel very different on Android 9 versus Android 15:

• Android 6 (2015): introduced runtime permissions for the dangerous group. Apps could no longer demand everything at install time; they had to ask when they used the feature.
• Android 10: three-state location permissions (Allow all the time / Allow only while using / Deny). Background location became a separately granted permission.
• Android 11: one-time permissions (grant for a single session) and automatic permission revocation for apps unused for several months.
• Android 13: separate notification permission for newly-installed apps; granular media permissions (READ_MEDIA_IMAGES, READ_MEDIA_VIDEO, READ_MEDIA_AUDIO) replacing blanket READ_EXTERNAL_STORAGE.
• Android 14: partial photo / video access, so apps can ask for "only these photos" instead of the entire library.
• Android 15: stricter foreground-service controls; declared service types must match the runtime permissions actually used.

If you are still on an older Android version, you do not get the newer protections. Be even more careful about what you install.

FAQ

If I deny a permission, will the app stop working?

Most apps degrade gracefully: the camera button is greyed out, the location-aware feature is disabled, and the rest still works. A small minority of badly-written apps crash or refuse to start, in which case ask whether you really need an app that demands so much.

Why does an app sometimes ask for a permission again?

Either you previously selected "Only this time" (a one-time grant), or the permission was revoked because you did not use the app for a long stretch and Android auto-revoked it. Both behaviours are intentional protections.

Can I see every permission an APK declares before I install it?

Yes. Drop the APK into our APK Info tool, and it parses the AndroidManifest.xml in your browser, decodes the binary XML format, and lists every uses-permission entry the app declared. Compare that list against what you would expect for the app's category before tapping "Install".APK Info tool

Managing Permissions on Your Device

How to Review App Permissions

1. Go to Settings → Apps
2. Select an app
3. Tap Permissions
4. Review and toggle permissions as needed

How to View All Apps with a Specific Permission

1. Go to Settings → Privacy → Permission Manager
2. Select a permission category (Camera, Location, etc.)
3. See all apps that have access to that permission
4. Revoke access from apps that don't need it

Android 13+ Permission Changes

Recent Android versions have made significant improvements to permission handling:

• Granular media permissions: Instead of full storage access, apps must request specific media types (photos, videos, audio)
• Notification permission: Apps must now ask permission to send notifications
• Auto-revoke: Permissions are automatically revoked for apps you haven't used in months
• Approximate location: You can grant approximate instead of precise location
• One-time permissions: Grant Camera/Microphone/Location for one session only

Practical Rules for Auditing App Permissions

Permissions are where a lot of your privacy is won or lost, so it pays to read them rather than tap through. Question anything that does not fit what the app is for, and run an APK through our APK Info extractor before you sideload it. A well-built app asks for what it needs to function and not much else.

If you have ever tried to manage files on an Android device, you probably noticed that things work differently depending on which version of Android you are running. Starting with Android 10, Google introduced a fundamental shift in how apps interact with the file system. This change, known as Scoped Storage, redefined the rules around reading and writing files on shared storage. For users who sideload apps, manage OBB files, or work with file managers, understanding scoped storage is essential.

In this article, we will explore what scoped storage is, why Google implemented it, how it affects everyday users and developers, and what it means for anyone who installs APK or XAPK files outside of the Play Store.

The Problem with the Old Storage Model

Before Android 10, any app that requested the READ_EXTERNAL_STORAGE or WRITE_EXTERNAL_STORAGE permission could access virtually any file on the device's shared storage. This included photos, documents, downloads, and even files created by other apps. While this made file management convenient, it created serious privacy and security concerns.

Consider a simple flashlight app. Under the old model, if you granted it storage permission, it could silently read your photos, scan your downloaded documents, or even modify files belonging to other applications. There was no granular control. You either gave an app full access to your entire storage or denied it completely.

This broad access led to real-world problems. Some apps harvested user data by scanning storage for sensitive files. Others left behind orphaned files that cluttered the device long after the app was uninstalled. Google needed a solution that balanced usability with privacy, and scoped storage was their answer.

What Scoped Storage Actually Does

Scoped storage fundamentally changes the relationship between apps and the file system. Under this model, each app gets its own private sandbox on external storage, typically located at /Android/data/[package.name]/. Apps can freely read and write within their own sandbox without needing any permissions at all.

However, accessing files outside of this sandbox requires going through controlled APIs. Here is how the new model works:

App-Specific Storage

Every app has a dedicated directory that only it can access. When the app is uninstalled, this directory is automatically cleaned up. No other app can read or write to this location without root access. This eliminates the problem of orphaned files and prevents cross-app data snooping.

Media Collections

For shared media like photos, videos, and audio files, Android provides the MediaStore API. Apps can contribute media to shared collections and read media created by other apps, but only through this structured interface. An app can see its own media without any permission, but accessing other apps' media requires the READ_MEDIA_IMAGES, READ_MEDIA_VIDEO, or READ_MEDIA_AUDIO permissions introduced in Android 13.

Storage Access Framework

For documents and other non-media files, apps must use the Storage Access Framework (SAF). This presents a system file picker to the user, who explicitly chooses which files or directories the app can access. The app never gets blanket access to the entire file system.

The MANAGE_EXTERNAL_STORAGE Permission

For apps that genuinely need broad file access, such as file managers, backup tools, and antivirus software, Android provides the MANAGE_EXTERNAL_STORAGE permission. However, this permission requires special approval from Google for apps distributed through the Play Store, and users must manually grant it through system settings rather than a simple dialog.

The Rollout Timeline

Google did not enforce scoped storage overnight. The transition happened gradually:

• Android 10 (API 29): Scoped storage was introduced but apps could opt out using requestLegacyExternalStorage="true" in their manifest. This gave developers time to adapt.
• Android 11 (API 30): The legacy flag was ignored for apps targeting API 30 or higher. Scoped storage became mandatory for new and updated apps on the Play Store.
• Android 12 and beyond: Further refinements were made, including granular media permissions and improved SAF performance.
• Android 13 (API 33): The broad READ_EXTERNAL_STORAGE permission was deprecated in favor of specific media permissions.
• Android 14 (API 34): Partial photo and video access was introduced, allowing users to grant access to specific files rather than entire media libraries.

How Scoped Storage Affects Sideloading

For users who install apps from outside the Play Store, scoped storage introduces some practical challenges that are worth understanding.

Downloading and Accessing APK Files

When you download an APK file through a browser, it typically lands in the Downloads folder. Under scoped storage, the browser app owns that file. If you want to install it using a different app, such as a file manager, that file manager needs appropriate access. Most modern file managers handle this correctly through SAF, but older ones may struggle.

The system package installer can still access files you explicitly select through the file picker, so the basic flow of downloading and installing an APK still works. However, automated installation workflows that relied on direct file path access may break.

OBB Files and Game Data

This is where scoped storage creates the most friction for sideloaders. Many large games use OBB (Opaque Binary Blob) files stored in /Android/obb/[package.name]/. Under the old model, you could simply copy OBB files to the correct directory using any file manager.

With scoped storage, the /Android/obb/ directory is restricted. On Android 11 and later, regular apps cannot write to another app's OBB directory. This means that if you download an XAPK file that contains OBB data, the installer needs special handling to place those files correctly.

Tools like our OBB Extractor can help you extract OBB files from XAPK packages, but placing them in the correct directory on newer Android versions may require using a file manager with MANAGE_EXTERNAL_STORAGE permission or using ADB commands from a computer.OBB Extractor

XAPK Installation Considerations

XAPK files bundle an APK together with OBB data and sometimes split APK configurations. Installing these on devices running Android 11 or later requires an installer that understands scoped storage restrictions. The installer needs to either hold the MANAGE_EXTERNAL_STORAGE permission or use the proper APIs to place OBB files in the correct location.

This is one reason why converting XAPK files to standard APK format can be useful. A standalone APK does not require OBB file placement, simplifying the installation process on newer Android versions. You can use our XAPK to APK converter to extract the base APK from an XAPK package.XAPK to APK converter

What Developers Need to Know

If you are developing Android apps, scoped storage requires rethinking how you handle files:

• Use app-specific directories for any files that only your app needs. These require no permissions and are automatically cleaned up on uninstall.
• Use MediaStore for photos, videos, and audio that should be visible to other apps and survive uninstallation.
• Use SAF when your app needs to work with user-selected documents or directories.
• Avoid hardcoded file paths. Paths like /sdcard/MyApp/ are no longer reliable. Use Context.getExternalFilesDir() instead.
• Test on multiple API levels. Behavior differs significantly between Android 10, 11, 13, and 14.

Migration Strategies

If your app previously stored files in shared storage, you need a migration plan. The recommended approach is to copy existing files to app-specific storage on first launch after the update, then delete the old copies. Use Environment.getExternalStorageDirectory() with the legacy flag during the transition period to read old files, then move them to the new location.

Common Misconceptions

"Scoped storage means apps cannot access any files"

This is false. Apps can still access their own files freely, contribute to shared media collections, and request access to specific files through the system picker. What changed is that apps can no longer silently browse the entire file system.

"File managers are broken on new Android versions"

File managers that request MANAGE_EXTERNAL_STORAGE still work. The user just needs to grant this special permission through settings. Most popular file managers have already adapted to this requirement.

"Scoped storage only affects the SD card"

Scoped storage applies to all shared storage, including internal shared storage. The term "external storage" in Android refers to shared storage that is accessible to multiple apps, not necessarily a physical SD card.

Practical Tips for Users

If you regularly sideload apps or manage files on your Android device, here are some practical recommendations:

1. Use a modern file manager that supports MANAGE_EXTERNAL_STORAGE. Apps like Solid Explorer, MiXplorer, and Total Commander have adapted well to scoped storage.
2. Grant permissions carefully. When a file manager asks for "All files access," understand that this is the MANAGE_EXTERNAL_STORAGE permission and is necessary for full functionality.
3. Use ADB for stubborn file operations. If you cannot place OBB files through a file manager, connecting your device to a computer and using adb push bypasses scoped storage restrictions entirely.
4. Convert complex packages to simpler formats. If an XAPK file is giving you trouble on a newer device, extracting just the APK component may be the path of least resistance.
5. Keep your installer apps updated. Older versions of XAPK installers may not handle scoped storage correctly.

The Future of Android Storage

Google continues to refine the storage model with each Android release. Android 14 introduced partial media access, letting users share specific photos with an app rather than their entire library. Android 15 is expected to bring further improvements to the Storage Access Framework's performance and usability.

The trend is clear: Android is moving toward a model where users have fine-grained control over what each app can see and modify. While this creates some friction for power users and sideloaders, it significantly improves privacy and security for the broader user base.

Working With Scoped Storage Without Breaking App Data

Scoped storage represents one of the most significant changes to Android's architecture in recent years. By restricting apps to their own sandboxes and requiring explicit user consent for broader access, Google has dramatically improved the privacy posture of the platform. For users who sideload apps and manage files manually, understanding these restrictions helps you work around the occasional friction points. And for developers, adapting to scoped storage is not optional but rather a fundamental requirement for modern Android development.

Installing APKs, placing OBB files, and just managing storage day to day all run into the same system: scoped storage. Once you understand how it works, you are the one in control of your device, instead of being at the mercy of apps that might abuse broad file access.

APK vs APKM vs XAPK: Understanding Different Android Package Formats

In the "good old days," there was only one type of file you needed to know for Android: the APK. But as apps have grown larger and more complex, new formats like APKM and XAPK have emerged to solve specific problems. These confusing extensions often lead to frustration when your phone says it doesn't know how to open them.

Below we break down how each of the three formats is put together, when you'll run into them, and how to deal with them using tools like our XAPK Converter and APKS/APKM Merger.XAPK ConverterAPKS/APKM Merger

1. The Classic: APK (Android Package)

The APK file is the standard archive format used for the distribution and installation of Android apps. Think of it like a .exe file for Windows or a .dmg for macOS.

• Structure: A single ZIP file containing compiled code (DEX), resources, and the manifest.
• Pros: Universal compatibility, easy to sideload, straightforward.
• Cons: Limited to 150MB for Play Store publishing; not efficient for different device architectures.

2. The Giant: XAPK (APK + OBB)

Developed primarily by the team at APKPure, the XAPK format was created to solve the file size limitation. Large realistic 3D games need gigabytes of data that simply won't fit in a standard APK.

• Structure: A ZIP container containing the base APK and an OBB expansion file.
• Installation: Requires an XAPK installer or manual extraction.
• Pro Tip: Use our XAPK to APK tool to split them up and install them manually for more control.XAPK to APK tool

3. The Specialist: APKM (APK Mirror Bundle)

APKM is a modern format introduced by APKMirror to handle "App Bundles." When Google moved to AAB, they stopped providing a single "fat" APK for every device. APKMirror responded by creating APKM, which bundles all the necessary split APKs for every device configuration into one file.

• Structure: A ZIP containing multiple encrypted or split APK pieces (Base + Configs).
• Efficiency: It allows users to download exactly what they need for their phone, similar to how the Play Store works.
• Requirement: Can only be installed using the APKMirror Installer app or by merging the splits here.merging the splits here

Feature Comparison Table

Which Format Should You Choose?

If you have a choice, follow these simple rules:

1. For Small Apps: Always choose APK. It's the simplest and fastest.
2. For Massive Games: Choose XAPK. It's the best way to get both the game and its high-res data in one download.
3. For Modern, Regular Apps: If an APK isn't available, APKM is your best bet as it ensures the app runs optimized for your specific phone's hardware.

Frequently Asked Questions (FAQ)

Summary: Picking Between APK, APKM, and XAPK

Android file formats keep getting more complex, but once the difference between APK, XAPK, and APKM clicks, managing your device gets a lot easier. Pulling data out of a massive game and merging splits for a custom ROM are very different jobs, and our suite of tools is built to make both of them painless. We'll keep publishing deep dives like this one on the blog.

Best XAPK to APK Converter Online: 2026 Comparison Guide

Looking for the best XAPK to APK converter online? With dozens of tools claiming to convert XAPK files, it can be confusing to choose the right one. Some upload your files to remote servers (privacy risk), some have file size limits, and others are filled with ads. The comparison below evaluates the top free XAPK to APK converter online tools available in 2026 based on privacy, speed, features, and reliability.

What Makes a Good Online XAPK Converter?

Before comparing tools, let's establish the criteria for the best online XAPK to APK converter:

• Privacy: Does the tool process files locally or upload them to a server?
• File Size Limit: Can it handle large XAPK files (games like PUBG can be 2GB+)?
• Speed: How fast does conversion complete?
• No Registration: Can you use it without creating an account?
• Cross-Platform: Does it work on PC, Mac, and mobile browsers?
• Additional Tools: Does it offer related utilities (APK info, verifier, etc.)?
• Ad-Free: Is the experience clean or cluttered with popups?

Top 5 Online XAPK to APK Converters Compared

1. xapktoapk.com (⭐ Editor's Choice)

Our XAPK to APK converter stands out as the best XAPK to APK converter online for several reasons:XAPK to APK converter

• ✅ 100% Browser-Based: Files never leave your device, processed entirely in JavaScript.
• ✅ No File Size Limits: Handles files up to 500MB+ (limited only by your device's RAM).
• ✅ No Signup/Login: Use instantly without creating any account.
• ✅ 10 Free Tools: Includes APK Info, Verifier, AAB Converter, OBB Extractor, and more.
• ✅ Cross-Platform: Works on Chrome, Firefox, Safari, Edge on PC, Mac, Android, iOS.
• ✅ Platform Guides: See the dedicated guides for Windows and macOS.WindowsmacOS

2. Online-Convert.com

A general-purpose file conversion platform that supports XAPK. However:

• ⚠️ Files are uploaded to their servers (privacy concern).
• ⚠️ Free tier has file size limits (100MB).
• ✅ Supports many other file formats beyond Android packages.

3. CloudConvert

Another general converter that supports XAPK to APK conversion:

• ⚠️ Server-side processing, files are uploaded to cloud servers.
• ⚠️ Free tier limited to 25 conversions per day.
• ✅ API available for developers.

4. Manual Method (Rename to ZIP)

While not a "tool" per se, you can convert XAPK to APK online free without software by:

1. Renaming the .xapk file to .zip
2. Extracting with your OS's built-in archive utility
3. Finding the base.apk inside the extracted folder

This works but requires manual OBB file placement and doesn't handle split APKs elegantly.

5. APKPure Online Converter

APKPure's website can handle XAPK files but primarily serves as an app store:

• ⚠️ Focused on distributing apps, not conversion.
• ✅ Reliable XAPK source with verified signatures.

Comparison Table

Why Privacy Matters in XAPK Conversion

Many online converters upload your XAPK files to their servers for processing. This means sensitive app data (potentially including login tokens, game saves, or private app files) is transferred to a third party. The best XAPK to APK converter online should process everything in your browser, no server upload, no data retention, no privacy risk. This is exactly what xapktoapk.com does.

Desktop vs. Online: When to Choose What

• Online (Browser): Best for quick, one-off conversions. No installation needed. Works on any device. Perfect for converting XAPK to APK online free without software.
• Desktop (PC/Mac): Better for batch conversions, very large files (2GB+), or offline use. Download our Windows or Mac app.WindowsMac
• Android (On-Device): Best when you want to convert and install immediately without a computer. Use our Android guide.Android guide

Frequently Asked Questions

Why Local Browser Merging Beats Upload-Based Converters

After putting the top XAPK to APK converter online tools for 2026 through their paces, xapktoapk.com kept coming out ahead on the things that matter most: privacy, speed, and genuinely free features. On a phone you can convert XAPK to APK online free without software; on a desktop the same tool handles batch jobs just as well. Whichever you choose, prioritize privacy, steer clear of converters that upload your files to a server, and always verify your APKs after conversion.

How to Convert AAB to APK Online: The Ultimate 2026 Guide

The Android App Bundle (AAB) has become the mandatory publishing format for the Google Play Store. While AAB offers numerous benefits for developers and end-users alike, it presents a significant challenge: AAB files cannot be installed directly on Android devices.

Testing a build before release and sideloading an app you already own are two very different reasons to reach for the same skill: knowing how to convert AAB to APK. The walkthrough below covers the best ways to do it both online and locally, using tools like our AAB to APK Command Builder.AAB to APK Command Builder

What is an AAB File?

Introduced by Google in 2018, the Android App Bundle (.aab) is a binary format that includes all your app’s compiled code and resources, but defers APK generation and signing to Google Play.

When a user downloads an app from the Play Store, Google uses the AAB to generate a Split APK optimized for that specific device's configuration (CPU architecture, screen density, and language). This results in smaller download sizes and faster installation times.

Why You Might Need to Convert AAB to APK

Since AAB is only for publishing, you might need an installable APK for several reasons:

• Sideloading: Installing the app on a device without using Google Play.
• Beta Testing: Sharing a build with testers via email or cloud storage.
• App Archiving: Keeping a backup of a specific version of an application.
• Security Analysis: Running a static scan on the final installable package.

Method 1: Using XAPKtoAPK.com AAB to APK Tool

Our website provides a sophisticated AAB to APK interface that helps you through the technical process. Because AAB conversion requires heavy processing (Java and bundletool), we provide a Command Builder that generates the exact terminal commands you need to run on your PC, alongside an AAB Explorer to inspect the internal files.AAB to APK interface

Steps to use our AAB to APK Builder:

1. Navigate to the AAB to APK Tool.AAB to APK Tool
2. Select your Operating System (Windows, macOS, or Linux).
3. Input your file paths (e.g., myapp.aab).
4. Configure your signing options (Debug key or Custom keystore).
5. Copy the generated command and run it in your terminal.

Method 2: Manual Conversion with bundletool

If you prefer to work entirely on your command line, you will need bundletool, the official tool provided by Google. Here is the technical breakdown:

Prerequisites:

• Java Development Kit (JDK) 8 or higher installed.
• The latest bundletool-all.jar file from the official GitHub repository.
• Your .aab file.

The Conversion Process:

Step 1: Generate APKS from AAB
Open your terminal and run:

java -jar bundletool.jar build-apks \
--bundle=myapp.aab \
--output=myapp.apks \
--mode=universal

Step 2: Extract the APK
The resulting .apks file is just a ZIP archive. Change the extension from .apks to .zip and unzip it. Inside the universal folder, you will find your installable .apk file.

Common Troubleshooting Tips

Converting AAB files can sometimes lead to errors. Here are the most common ones and how to fix them:

Frequently Asked Questions (FAQ)

Final Checklist Before Testing Your Converted APK

Converting AAB to APK is something you end up needing the moment you work outside the Play Store. Whether you reach for bundletool directly or our online builder to get the command right, the result is an APK you can actually install. Just remember to sign it properly if you plan to hand it to anyone else.online builder

How to Downgrade Android Apps to Older Versions Safely

Sometimes, an app update can be a disaster. Whether the developer removed your favorite feature, added excessive ads, or introduced bugs that make the app crash, you might find yourself wishing you never clicked "Update." Unlike iOS, Android allows you to roll back to an older version, but it's not as simple as clicking a button.

Below we'll get into how app downgrading actually works, what can go wrong, and how to roll back to an older, stable version without losing your data along the way.

Step 1: Backup Your Current Data

Before you touch anything, understand that uninstalling an app means losing all settings, level progress (for games), and locally stored data. Use these methods to backup first:

• Cloud Sync: Ensure Google Drive Sync or the developer's cloud backup (e.g., Facebook, Supercell ID) is active.
• Manual Data Copy: Move important files from /Android/data/[package_name] to your SD card or PC.
• Titanium Backup / Swift Backup: If you have ROOT access, you can back up the app data exactly as it is and restore it after the downgrade.

Step 2: Locate the Older Version You Legally Own

Identify the specific older version you need to install. Acceptable sources include the application publisher's own changelog and release archive (some developers maintain a complete history of signed builds), an APK you previously exported from your own device, or, for open-source software, the project's official version-tagged release page on its source-control host.

Step 3: Uninstall the Current Version

For most apps, simply long-press the icon and click Uninstall. If it's a pre-installed app (like YouTube or Chrome):

1. Go to Settings > Apps.
2. Find the app and tap it.
3. Tap the three dots in the top-right corner.
4. Select "Uninstall Updates". This will revert the app to the version that came with your phone.

Step 4: Install the Older APK

Open the older APK you downloaded in Step 2. You will be asked if you want to install. Once finished, do not launch it until you complete the next step.

Step 5: Disable Auto-Updates (Crucial)

If you don't do this, the Play Store will "auto-correct" you back to the latest version within hours.

1. Open the Play Store.
2. Search for your app and open its listing page.
3. Tap the three dots (top-right).
4. Uncheck "Enable auto-update".

Common Downgrade Issues

• "App Not Installed": This usually happens because the system detects leftover data from the newer version. Restart your phone and try again.
• Login Failures: Some online apps (like Netflix or banking) block older versions for security. If the app forces an update to start, you cannot downgrade.
• Corrupted Data: Android/data files from version 3.0 might not be readable by version 2.0. In this case, you'll need to start fresh.

Safe App Rollback Checklist

Downgrading is a useful escape hatch when an update breaks a workflow you depend on. It takes some effort and puts your app data at risk, but it's the realistic way to get back a version that actually worked for you. Whatever you roll back to, verify any old APK from a third-party source first so you know it hasn't been tampered with.verify any old APK

Extracting APK Files from Your Installed Android Apps

You have an amazing app on your phone that you spent hours setting up, only to find out it's been removed from the Play Store. Or maybe you're switching to a new device and want an offline copy of your favorite tools just in case. Extracting APK files from your currently installed apps is the solution.

Below we walk through pulling an APK off your phone without root, where this comes in handy for backups, and how to check an extracted file afterward with our online analysis tools.online analysis tools

Why Extract APKs?

Before jumping into the "how," here is why you should maintain an APK backup library:

• Preserve Discontinued Apps: If a developer removes their app from the store, you'll still have your installable copy.
• Legacy Hardware Support: Keep versions that work on your older tablet when the official app updates to require newer Android versions.
• Version Rollback: If an update introduces bugs, you can reinstall your extracted backup and be back in business.
• App Sharing: Send a specific app version to a friend via Bluetooth or cable without using cellular data.

Method 1: Using an APK Extractor App (No Root)

The easiest way is to use a dedicated utility. There are dozens of "APK Extractor" apps available on the Play Store. These tools work by finding the app's installation path in /data/app/ (which is readable but normally hidden) and copying the base.apk to your public Download folder.

Steps:

1. Install a reputable APK Extractor.
2. Open the app and grant "Storage Permissions" if requested.
3. Scroll through the list of all installed applications.
4. Tap on the app you want to save.
5. The tool will instantly copy the APK to your internal storage.

Method 2: Manual Extraction via ADB (Advanced)

If you don't want to install extra apps on your phone, you can use a PC with Android Debug Bridge (ADB):

1. Connect your phone to your PC via USB and enable USB Debugging.
2. Open a terminal and type: adb shell pm path com.example.app
3. This will show the path. Example: package:/data/app/com.example.app/base.apk
4. Type: adb pull /data/app/com.example.app/base.apk ./backup.apk
5. The file is now on your PC!

What You Actually Get When You Extract

An "installed" Android app is not stored on the device as a single APK any more, especially if it came from the Play Store as an Android App Bundle. When you extract, you may get one file or several, and knowing the difference helps you decide what to keep:

• A single base APK. Older or smaller apps that were uploaded to Play as a plain APK still install as a single file. Extraction returns one .apk that is self-contained.
• Base APK + several config splits. Apps published as AAB are installed as multiple APKs side by side: a base.apk plus split_config.<abi>.apk (native code for your CPU), split_config.<density>.apk (resources for your screen), and split_config.<language>.apk (strings for your locale). Extraction returns all of them. To re-install the same app on the same device, you need them all.
• Asset-pack data, sometimes. Modern games using Play Asset Delivery store large gameplay assets in app-private cache outside the APKs themselves. These typically cannot be exported with a regular extractor; the asset packs are designed to be re-fetched on first launch.

If your goal is a portable backup that will install on another device, you usually want either (a) a merged "universal APK" produced with our APKS to APK merger, or (b) all the splits archived together so a split-APK installer such as SAI can restore them as a unit.APKS to APK merger

How Extraction Works (No Root, Behind the Scenes)

Most "APK extractor" apps do not actually need root because Android exposes installed package files through a system-level read path. The standard flow is:

1. The extractor app calls PackageManager.getPackageInfo(package, ...) to get the list of installed apps.
2. For the chosen app, it reads ApplicationInfo.sourceDir (the path of the base APK, typically /data/app/<package>-<hash>/base.apk) and splitSourceDirs (paths of any config splits).
3. The user-installed extractor cannot read these paths directly, but the FileProvider mechanism in Android lets system components grant temporary read access to specific URIs. The OS does let any app open its own APKs and other apps' APKs by URI; this is intentional, since the install path was always meant to be world-readable for tasks like uninstall and update.
4. The extractor copies the bytes into a writable user directory (Downloads, an in-app cache folder, or external storage) and presents them as a file to share or install.

Root-only methods (su; cp /data/app/...) bypass the API and read raw paths directly. They are not faster and not necessary for non-system apps.

Extracting via ADB (Recommended for Backups)

The cleanest non-app workflow is ADB, which most developers already have set up. Two commands do the entire job:

# 1. Find the on-device path(s) for the package
adb shell pm path com.example.app

# Output (single APK):
#   package:/data/app/~~hash==/com.example.app-1/base.apk
#
# Output (split APKs):
#   package:/data/app/~~hash==/com.example.app-1/base.apk
#   package:/data/app/~~hash==/com.example.app-1/split_config.arm64_v8a.apk
#   package:/data/app/~~hash==/com.example.app-1/split_config.xxhdpi.apk
#   package:/data/app/~~hash==/com.example.app-1/split_config.en.apk

# 2. Pull each path
adb pull /data/app/~~hash==/com.example.app-1/base.apk ./

For split-APK apps, repeat adb pull for each path. To get a single installable file, drop all of them onto our APKS to APK merger.APKS to APK merger

What Cannot Be Extracted

Extraction returns the application's installation files. It does not return:

• App data: preferences, databases, save files. Those live under /data/data/<package>/ and are protected from non-root extraction by the user-data sandbox.
• Play Asset Delivery asset packs: downloaded on first run, cached privately, and expected to be re-fetched if missing.
• Cloud-saved progress: if the app uses Google Play Games, Firebase, or similar, the cloud-stored portion is on the publisher's servers, not on your device at all.

Extraction is therefore good for "I want a copy of the installer to keep around" use cases, but not a substitute for proper full-device backups (which require root or vendor tooling).

Frequently Asked Questions (FAQ)

Backing Up Installed Apps Without Losing Split Configurations

Building your own local app repository is the surest way to never lose access to the tools you love. A tap-friendly app and the ADB terminal both get you there, and either way extracting APK files is a safe, practical way to manage your Android device. After you back up your library, take a moment to verify the signatures of those backups so you know they stay untampered over time.verify the signatures

How to Extract Icons from Android APK Files Online

Designers hunting for inspiration, reviewers putting together thumbnails, developers checking a competitor's assets, the need to extract icons from APK files comes up more often than you might expect. The catch is that digging through internal folders like res/mipmap by hand is a slow, fiddly process.

This walkthrough covers the quickest way to pull high-resolution app icons out of an APK, how Android stores icon resources in the first place, and how our APK Icon Extractor tool handles the fiddly parts for you in seconds.APK Icon Extractor tool

Why Extract APK Icons?

App icons represent the identity of an application. There are several reasons why you might want to extract them as a standalone PNG or SVG file:

• UI/UX Design: Analyzing icon styles, colors, and shadow effects.
• Content Creation: Using high-quality logos for YouTube thumbnails or blog post headers.
• Device Customization: Creating your own custom icon packs based on original designs.
• App Verification: Comparing the extracted icon with the official one to ensure validity.

Understanding Android Icon Resources

Inside an APK, the icon is defined in the AndroidManifest.xml under the android:icon attribute. Modern apps use several types of icon formats:

1. Mipmaps: Raster images (PNG, WebP) stored in folders named mipmap-xxxhdpi, mipmap-xxhdpi, etc.
2. Vector Drawables: XML-based vectors that scale infinitely without losing quality.
3. Adaptive Icons: These use a separate background and foreground layer, allowing Android to apply different masks (circles, squares, squircles) to the icon.

How to Extract Icons Online (The Standard Method)

Our online APK Icon Extractor is built to handle all these complexities automatically. Here is how simple the process is:online APK Icon Extractor

Step-by-Step Extracting:

1. Navigate to our Icon Extractor Tool.Icon Extractor Tool
2. Upload your .apk or .xapk file.
3. The tool instantly parses the AndroidManifest.xml to find the icon's resource path.
4. It scans the res/ directory for the highest resolution available (usually xxxhdpi).
5. A preview of the icon is displayed on the screen.
6. Click Download Icon to save it as a high-quality PNG.

Manual Method (Using a ZIP Opener)

If you don't have internet access, you can extract icons manually, though it's more complicated:

1. Rename your app.apk to app.zip.
2. Open the ZIP file.
3. Navigate to /res/.
4. Look for folders starting with mipmap-.
5. Search through these folders for an image file named ic_launcher.png.
6. Copy the file from the largest folder (e.g., xxxhdpi).

Warning: This method often fails with Adaptive Icons or apps using specialized naming conventions.

Adaptive Icons: Why You See Two Layers

Since Android 8 (Oreo), the platform has used adaptive icons: a two-layer system that lets the OS clip and animate the icon into different shapes (circle on Pixel, squircle on Samsung One UI, rounded square on stock launchers, teardrop on some OEM skins). When you extract an adaptive icon, you get two PNGs (or two vector drawables) instead of one:

• Foreground layer: the actual logo or symbol. It is always drawn on top and must stay inside the safe-zone (a 66 dp circle in the centre of the 108 × 108 dp canvas).
• Background layer: a flat colour, a gradient, or a simple pattern. The launcher uses this to fill the area outside the foreground after clipping.
• Optional monochrome layer: introduced with Android 13 themed icons. It contains a single-colour silhouette that the launcher tints to match the user's wallpaper-derived theme palette.

If you only export the foreground PNG, you will end up with an image that has either no background or a transparent background, which is fine for assets in design mock-ups but wrong if you want a launcher-ready icon. Always export both layers, or use the APK Icon Extractor, which automatically composites them for you when an adaptive icon is detected.APK Icon Extractor

Density Folder Cheat Sheet

Inside an APK, the same icon may exist in five or more sizes, one per pixel-density bucket. The launcher picks the bucket closest to the device's density. When you are extracting the highest quality version, head straight for xxxhdpi:

The rare anydpi-v26 folder is special: it contains XML files that reference the foreground and background drawables stored elsewhere. If you only see XML when you open the mipmap folders, the actual graphics are in res/drawable-* or as vector XML in res/drawable/. The browser tool follows these references automatically.

Vector vs Raster: Which Should You Export?

Modern Android apps prefer vector drawables (XML files using a subset of SVG) for icons and small UI graphics. They scale infinitely, weigh almost nothing, and one file covers every density. Older apps still ship raster PNGs at every density. When you extract, you may encounter either format:

• Vector XML (file extension .xml, root tag <vector>), convertible to SVG with a one-line attribute swap, or rasterised by our tool to the size you specify.
• WebP (compact lossy/lossless): modern apps may ship icons in WebP at each density. Our extractor decodes WebP and lets you re-export as PNG if you need broader compatibility.
• PNG: the universal format. What you see is what you get.

For design work, prefer the vector source whenever it exists; for legacy compatibility (older tools, marketing materials), export the highest-density PNG you can find.

Common Pitfalls When Extracting Icons

• Confusing res/mipmap with res/drawable. mipmap holds launcher icons; drawable holds in-app images. Both can contain icon-like assets, but only mipmap entries are referenced by android:icon in the manifest.
• Picking the wrong density. If you are designing for a 4K display, the 48 × 48 mdpi version will look pixelated. Always start from xxxhdpi or the vector source.
• Forgetting the round variant. Many apps declare both ic_launcher and ic_launcher_round, with subtly different cropping. Some launchers always pick the round one. Extract both.
• Ignoring trademark. The legal note above applies. Extracting an icon for personal reference or to improve accessibility is fine; using a shipped commercial logo as your own product's icon is not.

Frequently Asked Questions (FAQ)

Getting Clean Launcher Assets Every Time

Pulling icons out of an APK is a handy trick if you design, review, or build Android apps. You can do it by hand, but a dedicated online tool is quicker and gets you the full-resolution source without the guesswork. It is a free part of our APK toolset whenever you need it.online tool

What are OBB Files? How to Extract and Install OBB Manually

Have you ever downloaded a high-end mobile game like Genshin Impact or Call of Duty Mobile outside the Play Store and found it refused to start? Or perhaps you downloaded a file with the extension .obb and didn't know what to do with it? You're not alone. Managing game data is one of the more complex parts of the Android ecosystem.

Below we'll clear up what OBB files (Opaque Binary Blobs) actually do, where they fit in your favorite apps, and how to extract and install them with our OBB Extractor tool. Get the file in the right place and a big game that refused to launch usually just works.OBB Extractor tool

Understanding the OBB Format

The Google Play Store has a strict limit on the size of an APK file (currently 150MB). However, modern mobile games are significantly larger, often weighing in at 2GB, 5GB, or even 10GB. To bypass this limit, Google introduced OBB expansion files.

An OBB file is essentially a compressed container that holds all the "heavy" assets for an application. Developers use it to store:

• High-resolution textures and 3D models.
• Advanced sound effects and orchestral soundtracks.
• Cutscenes and cinematic videos.
• Game engine maps and physics data.

Why Manual OBB Installation is Necessary

When you install an app from the Play Store, Android handles everything automatically. But when you sideload an app as an XAPK or a standalone APK + OBB set, the system doesn't know where to put the data. Without the OBB, the app will often show a black screen or an error saying "Download failed because you may not have purchased this app."

How to Extract OBB from XAPK Online

If you have an .xapk file, it almost certainly contains an OBB file inside it. Instead of using complex software on your phone, you can use our online extractor.

Steps to use OBB Extractor:

1. Navigate to the OBB Extractor Tool.OBB Extractor Tool
2. Drag and drop your .xapk file into the upload area.
3. The tool will automatically scan the internal structure and identify the .obb file.
4. Once extracted in your browser, click Download OBB to save it to your computer or device.
5. Also, remember to download the .apk file if you haven't installed the app yet.

How to Install OBB Files Manually (Step-by-Step)

Once you have the .apk and .obb files, follow these steps to install the game properly:

Step 1: Install the APK

Run the APK file to install the app. Do NOT open the app yet after it finishes installing.

Step 2: Find the Package Name

The OBB file name usually looks like main.12345.com.example.app.obb. The part after the numbers (e.g., com.example.app) is the package name.

Step 3: Create the Destination Folder

1. Open your phone's File Manager.
2. Navigate to Internal Storage / Android / obb.
3. Create a new folder and name it exactly after the package name (e.g., com.example.app).

Step 4: Move the OBB File

Copy your OBB file and paste it into the new folder you just created. Your final path should look like: /Android/obb/com.example.app/main.12345.com.example.app.obb.

Step 5: Launch the Game

Now, open the app. If you've done it correctly, it will recognize the data and start loading resources!

Frequently Asked Questions (FAQ)

Verifying OBB Placement Before Launching Your Game

OBB files trip up a lot of Android users, but once you understand them they are not hard to handle. An online OBB extractor plus the right folder structure is all you need to install a big game outside the Play Store and keep its data where Android expects it.online OBB extractor

How to Fix a Corrupt APK File and Extract Assets

You’ve spent hours downloading a 2GB game bundle, only for your browser to say "Download Failed" at 99%, or worse, for Android to scream "Parsing Error: There was a problem parsing the package." A corrupted APK isn't necessarily a dead file. Because APKs are built on the ZIP compression standard, they can often be repaired, at least enough to extract the precious assets inside.

Below we get into what actually breaks inside an APK, the repair tools worth reaching for, and how our XAPK Converter can help when you are dealing with a broken bundle.XAPK Converter

The Anatomy of APK Corruption

An APK is essentially a ZIP archive with a specific structure. Corruption typically happens in one of three places:

1. The Header: The bytes at the very beginning of the file are missing or changed.
2. The Manifest (XML): The AndroidManifest.xml is malformed or uses an unsupported encoding.
3. The DEX Code: The actual Java/Kotlin bytecode is truncated, making the app unrunnable.

Method 1: Headless ZIP Repair (Easiest)

If the file is "readable" but won't open, use a tool like DiskInternals ZIP Repair (Free) or the command-line zip -FF command in Linux/macOS. These tools scan the file for "signatures" of files and rebuild the central directory from scratch.

Code for Terminal users: zip -FF corrupt_app.apk --out fixed_app.apk

Method 2: Fixing Zipalign/Alignment

Sometimes an APK is "corrupt" simply because it isn't aligned on 4-byte boundaries. Android's memory management requires this. You can fix this using the zipalign tool from the Android SDK:

zipalign -v 4 input.apk output.apk

How to Tell What's Actually Wrong

Before you pick a repair tool, identify the failure. The error message Android (or your archive tool) shows is usually a clue:

A Concrete Walk-Through

Imagine you ended up with a 320 MB APK whose download was interrupted at roughly 99%. Your phone refuses to install it with "Parsing the package failed." Here is how to attack it on a Windows or macOS workstation, in the order you would actually try things.

Step 1. Confirm the file is at least mostly there

Check the file size against whatever the source advertises. If the file is dramatically smaller (say, 220 MB instead of 320 MB), the download was severely truncated and there is little point repairing the wrapper: large parts of classes.dex or the assets are simply missing. In that case, restart the download.

Step 2. Test the ZIP structure

Open a terminal in the folder containing the APK and run, on macOS or Linux:

unzip -t broken.apk

The tool will report each file inside the archive and any CRC errors. If only a handful of entries error out and they are not classes*.dex or resources.arsc, you have a decent chance of producing a working install.

Step 3. Rebuild the central directory

If unzip -t complains about the central directory itself ("end-of-central-directory signature not found", "missing 1 EOCD"), use the "fix" mode:

zip -FF broken.apk --out fixed.apk

The -FF flag tells zip to scan the file for local file-header signatures and rebuild the directory entry-by-entry. The output, fixed.apk, is what you actually try to install.

Step 4. Realign and re-sign if necessary

After any structural change, the APK's signature is no longer valid, because modifying even one byte invalidates the v2/v3 signature blocks. If you have your own signing key (this is fine for builds you own), align and re-sign:

zipalign -v 4 fixed.apk aligned.apk
apksigner sign --ks my.keystore aligned.apk

Without your own key, the only way to install the file is via existing install with the same signing certificate, which means a repaired APK from a third party will not install on top of an existing Play Store install, since the signing chain has changed.

When Repair Is the Wrong Goal

It is worth being honest about what "fixing" can and cannot do:

• You cannot recover bytes that never arrived. If the download was truncated, no header repair will reconstruct missing data. Re-download.
• Bit-rot is permanent. If a file sat on storage that flipped a few bits inside classes.dex, the bytecode verification step at install time will reject it, and there is no way to know what the original bytes were supposed to be.
• Repaired files have new signatures. Even a perfectly fixed APK is no longer signed by the original publisher. That is a feature, not a bug: it prevents an attacker from slipping malicious code into a popular app and re-signing as if they were the original publisher.

If your goal was simply to play a game whose download died at 99%, the path of least resistance is almost always to clear the partial file, free up disk space, and download again from a reliable connection. Repair tools shine when re-download is impossible: old archived APKs, files received over a flaky LAN transfer, or backups whose original source is gone.

Frequently Asked Questions

Can I extract the icons and screenshots from a broken APK?

Usually yes. Icon files live under res/mipmap-* and screenshot data is rare in APKs to begin with. Even when the central directory is damaged, individual file headers are intact often enough that 7-Zip's "Extract with errors ignored" option will pull most images out.

Will a repaired APK update an installed app?

Only if the repair preserved the original signature, which is generally impossible after a structural fix. Treat a repaired APK as a fresh install: uninstall the old version first (you will lose its data) or install on a device that does not yet have the app.

Is there an online tool that does all of this?

Browser-based tools can read an APK's structure and tell you what is broken (our APK Info tool does exactly that), but actually rewriting the ZIP and re-signing requires either a desktop tool or a server. We deliberately do not run the re-sign step on a server because that would mean uploading your file: the privacy promise of this site is that nothing leaves your browser.APK Info tool

What about XAPK files that fail to extract?

An XAPK is just a ZIP, so the same techniques apply. Run zip -FF on it to recover the inner APK plus any OBB files, then proceed as if you had a damaged APK and a separate OBB.

If your goal is just to get the graphics, sounds, or OBB data from a failed download, use 7-Zip. 7-Zip is more aggressive than the Windows Explorer ZIP tool and will often let you "Ignore errors" to extract files that are only partially downloaded.

Conclusion

A "Parsing Error" is the OS giving up. By using the tools mentioned above, you take control back. While you can't always "fix" a broken app to make it run, you can almost always recover the data inside. For more tips on managing large files, check out our guide on Merging Split APKs or Extracting OBB Game Data.Merging Split APKsExtracting OBB Game Data

Troubleshooting XAPK Installs on Xiaomi HyperOS/MIUI, Samsung Auto Blocker & Google Play Integrity

Android 14 and Android 15 introduced major OS-level security changes across Xiaomi (HyperOS / MIUI), Samsung (One UI 6 and One UI 7), and Google Play Services. If you are a developer testing an exported build or a user restoring a legitimate package backup, understanding how MIUI Optimization, Samsung Auto Blocker, and the Google Play Integrity API interact with converted APK files will save you hours of confusion.

1. Installing XAPK on Xiaomi, Redmi & POCO Without Disabling "MIUI Optimization"

When you try to install a multi-part .xapk or .apks bundle on a Xiaomi, Redmi, or POCO phone using a third-party split installer (such as SAI), Xiaomi's custom PackageInstaller hooks reject the multi-APK session unless you go into Developer Options and turn off System Optimization (MIUI Optimization).

Why disabling MIUI Optimization is a bad idea: Turning off System Optimization resets runtime permissions (contacts, storage, notification access) across dozens of installed apps, changes floating window behavior, and resets custom font scaling.

The Cleaner Solution: Instead of disabling MIUI Optimization to run a split installer, convert the .xapk bundle into a single merged .apk using our XAPK to APK Converter. Because the output is a single standard .apk file rather than a multi-APK PackageInstaller.Session, Xiaomi HyperOS and MIUI install it through the normal single-APK dialog with System Optimization kept 100% enabled.XAPK to APK Converter

2. Samsung Galaxy One UI 6 & One UI 7: Understanding "Auto Blocker"

On Samsung Galaxy phones and tablets running One UI 6.0, 6.1, or 7.0, Samsung includes a security feature called Auto Blocker (located under Settings → Security and Privacy → Auto Blocker). When active, Auto Blocker prevents any application package—whether an .apk or a converted .xapk—from being installed outside the Google Play Store or Samsung Galaxy Store, and also blocks ADB commands over USB.

• If you are testing your own signed development build or installing a verified open-source release (such as from F-Droid or an official GitHub repository), you can review the Auto Blocker setting under Settings → Security and Privacy → Auto Blocker.
• Before installing any package outside an official store on a Samsung device, always inspect its cryptographic certificate using our APK Signature Verifier.APK Signature Verifier

3. Why Some Converted Apps Show "Get This App from Play" (Google Play Integrity & PairIP)

Starting in 2024–2026, many commercial Android applications integrate Google's Play Integrity API and automatic PairIP license verification (com.pairip.licensecheck). When an app built with this protection launches, it queries the local Google Play Store service to verify two things:

1. That the application binary is signed with the original developer's official release certificate (meaning it has not been repackaged or re-signed).
2. That the user's Google account holds a valid installation record ("installer package name = com.android.vending") from the official Google Play Store.

Why This Happens & What You Should Do: When a split .xapk archive is merged into a single .apk, the converter must apply a fresh v1+v2 cryptographic signature so Android's package manager accepts the combined archive. If the app developer has explicitly enabled Google Play Integrity or PairIP anti-tamper licensing, the app will detect that its signature or installer source differs from the Play Store and display the screen "Get this app from Play".

This security mechanism exists to protect software developers against unauthorized modification and piracy. We strictly support developer intellectual property rights: if an application enforces Play Integrity licensing, do not attempt to bypass or tamper with its license check—always install the app directly from the official Google Play Store.

Why Renaming .XAPK to .APK Causes "Problem Parsing the Package" & How to Fix "XAPK File Validation Failed"

One of the most common myths repeated on forums is that you can turn an .xapk file into an installable Android app simply by renaming the file extension from .xapk to .apk. If you try that on Android 12, 13, 14, or 15, the system immediately halts with "There was a problem parsing the package" (or "App not installed as package appears to be invalid"). Here is the exact binary reason why renaming fails—and how to fix archives that trigger "XAPK File Validation Failed".

1. Why Renaming .xapk to .apk Never Works

Although both .apk and .xapk files use the PKZIP archive format under the hood, Android's PackageParser looks for three mandatory items at the root of an .apk file before it will even display the install prompt:

• A compiled binary AndroidManifest.xml at the exact root of the ZIP archive.
• Compiled Dalvik/ART bytecode (classes.dex) and a compiled resource table (resources.arsc) aligned on 4-byte boundaries.
• An APK Signature Scheme v2/v3 Signing Block or META-INF/ JAR signature covering every entry in the archive.

An .xapk file has none of those at its root. Instead, the root of an .xapk contains a JSON text file (manifest.json), an icon.png, and multiple nested .apk files (base.apk, config.arm64_v8a.apk, config.xxhdpi.apk). When you rename game.xapk to game.apk, Android opens the outer ZIP, sees no AndroidManifest.xml at the root, and immediately throws a Package Parsing Error.

2. Can You Rename .xapk to .zip Instead?

Yes—renaming .xapk to .zip allows any archive utility (Windows Explorer, macOS Archive Utility, or ZArchiver) to view the files inside. However, for modern split-APK bundles, simply extracting base.apk from the ZIP still fails on Android with INSTALL_FAILED_MISSING_SPLIT because the CPU libraries (lib/*.so) and high-DPI drawables live in separate config.*.apk files. To turn a split .xapk into a working single .apk, all splits must be merged, the binary manifest's isSplitRequired flag must be patched, and the merged archive must be re-signed using our XAPK to APK Converter.XAPK to APK Converter

3. Three Root Causes of "XAPK File Validation Failed"

If you use a dedicated XAPK installer and receive the error "XAPK File Validation Failed", the installer's pre-flight check failed for one of three technical reasons:

1. Truncated Browser Download (total_size Mismatch): Mobile browsers frequently drop large 1.5 GB downloads when the screen locks. Even if 99% of the file downloaded, the ZIP End of Central Directory (EOCD) record or the final .obb entry is incomplete.
2. Missing Split or OBB Referenced in manifest.json: If the manifest.json file lists "file": "config.arm64_v8a.apk" inside split_apks[] or "file": "Android/obb/com.example/main.obb" inside expansions[], and that exact path is missing inside the ZIP, validation fails immediately.
3. Corrupted JSON Syntax in Repacked Archives: Manually edited .xapk archives often have trailing commas or UTF-8 BOM bytes in manifest.json.

4. How to Diagnose and Repair Your XAPK File in Seconds

Instead of guessing whether your download is corrupt, run this two-step browser check:

1. Drop your .xapk file into our XAPK Archive Viewer & Validator. It reads the ZIP central directory locally and checks every entry declared in manifest.json against the actual files inside the package.XAPK Archive Viewer & Validator
2. If the validator confirms that base.apk and your architecture splits are intact (even if manifest.json has a metadata mismatch), drop the .xapk directly into our homepage XAPK to APK Merger to generate a clean, standalone signed .apk that installs via Android's native Package Installer without needing manifest.json at all.homepage XAPK to APK Merger

When you tap "Install" on an APK file or download an app from the Play Store, a complex sequence of operations begins behind the scenes. What appears to be a simple progress bar actually represents dozens of steps involving package parsing, cryptographic verification, permission management, file extraction, and code optimization. Understanding this process helps explain why installations sometimes fail and what you can do about it.

In this article, we will walk through every major step of the Android installation pipeline, from the moment the system receives an APK to the point where the app is ready to launch.

Step 1: Initiating the Installation

The installation process begins differently depending on the source:

• Play Store: The Play Store app downloads the APK (or split APKs) and calls the system's package installer with special privileges that bypass some user confirmations.
• Sideloading: When you open an APK file, Android launches the package installer activity. On Android 8.0 and later, the installing app must have the "Install unknown apps" permission for its specific source.
• ADB: The adb install command communicates directly with the package manager service over USB, bypassing the graphical installer entirely.

Regardless of the source, all installations eventually reach the same system service: the PackageManagerService (PMS). This is the central authority for all package operations on Android.

Step 2: Package Parsing

Before anything else, the system needs to understand what it is about to install. The PackageManagerService invokes the PackageParser to read the APK file and extract its metadata.

The parser reads the AndroidManifest.xml file from within the APK. This binary XML file contains critical information:

• Package name: The unique identifier for the app (e.g., com.example.myapp)
• Version code and name: Used to determine if this is an upgrade or a fresh install
• Minimum and target SDK versions: Determines compatibility with the device
• Declared permissions: Both permissions the app requests and custom permissions it defines
• Components: Activities, services, broadcast receivers, and content providers the app registers
• Hardware and software features: Requirements like camera, GPS, or specific OpenGL versions

If the manifest is malformed or the APK structure is invalid, the installation fails at this stage with a "Parse error" message. This is one of the most common reasons sideloaded APKs fail to install.

Step 3: Compatibility Checks

Once the manifest is parsed, the system performs a series of compatibility checks:

• SDK version: If the app's minSdkVersion is higher than the device's API level, installation is rejected.
• ABI compatibility: If the APK contains native libraries, the system checks whether they match the device's CPU architecture. An APK with only armeabi-v7a libraries will not install on an x86-only device.
• Required features: If the app declares required hardware features (like android.hardware.telephony), the system verifies the device supports them.
• Available storage: The system checks whether there is enough free space to install the app, including space for the extracted native libraries and optimized DEX files.

Step 4: Signature Verification

This is one of the most critical steps in the installation process. Android verifies the cryptographic signature of the APK to ensure its integrity and authenticity.

The verification process depends on which signing schemes are present:

V1 Signature (JAR Signing)

The system checks the META-INF/ directory for signature files (.SF, .RSA or .DSA). Each file in the APK is verified against the digests listed in the manifest. This is slow because every file must be individually hashed.

V2 Signature (APK Signature Scheme v2)

Introduced in Android 7.0, this scheme signs the entire APK as a binary blob. The signature block is inserted between the ZIP central directory and the end-of-central-directory record. Verification is much faster because it operates on the raw bytes without needing to decompress individual entries.

V3 Signature (Key Rotation)

Available from Android 9.0, V3 extends V2 with support for key rotation. It includes a proof-of-rotation structure that links old and new signing keys, allowing developers to change their signing key while maintaining update compatibility.

V4 Signature (Incremental)

Android 11 introduced V4 for incremental installations. It provides a Merkle tree-based signature that allows verification of individual blocks as they are streamed to the device.

If the signature verification fails for any reason, the installation is immediately aborted. You can check an APK's signature before installation using our APK Verifier tool.APK Verifier tool

Update Signature Matching

If an app with the same package name is already installed, the system performs an additional check: the new APK's signing certificate must match the existing installation's certificate. This prevents a malicious party from replacing a legitimate app with a tampered version. If the signatures do not match, you will see the error "App not installed: The package conflicts with an existing package by the same name."

Step 5: User Confirmation

For sideloaded installations, the system displays an installation confirmation dialog showing:

• The app name and icon (extracted from the APK's resources)
• Permissions the app requests (on older Android versions)
• Whether this is a new installation or an update
• Any warnings about the app's source or potential risks

On Android 12 and later, the confirmation screen is simpler since runtime permissions are granted individually when the app first needs them, rather than at install time.

Step 6: File Extraction and Placement

Once the user confirms (or for Play Store installs, automatically), the system begins extracting and placing files:

APK Storage

The APK file itself is copied to /data/app/[package-name]-[random]/base.apk. For split APK installations, additional files like split_config.arm64_v8a.apk are placed alongside the base APK. The original APK in the Downloads folder is not modified or deleted.

Native Library Extraction

If the APK contains native libraries (in the lib/ directory), they are extracted to /data/app/[package-name]-[random]/lib/[abi]/. On newer Android versions, apps can opt to keep native libraries compressed within the APK and load them directly using android:extractNativeLibs="false", which saves storage space.

Data Directory Creation

The system creates the app's private data directory at /data/data/[package-name]/ (or /data/user/0/[package-name]/ on multi-user devices). This directory is owned by a unique Linux UID assigned to the app, ensuring no other app can access it without root privileges.

Step 7: DEX Optimization

This step is where Android transforms the app's bytecode into a format optimized for the device's specific hardware. The process has evolved significantly over Android's history:

The Dalvik Era (Android 4.4 and earlier)

The original Dalvik virtual machine used Just-In-Time (JIT) compilation. During installation, the classes.dex file was optimized into an ODEX file that contained verified and optimized bytecode. This was relatively fast but meant the app ran slower at runtime since most code was still interpreted.

ART with AOT (Android 5.0 to 6.0)

Android Runtime (ART) replaced Dalvik and introduced Ahead-Of-Time (AOT) compilation. During installation, the entire DEX bytecode was compiled to native machine code. This made apps run faster but significantly increased installation time and storage usage. Some apps took several minutes to install.

Profile-Guided Compilation (Android 7.0+)

Modern Android uses a hybrid approach. During installation, only critical startup paths are compiled. As the user runs the app, the system collects execution profiles identifying frequently used code paths. During idle maintenance (typically while charging overnight), the system compiles these hot paths to native code. This balances installation speed, storage usage, and runtime performance.

The compiled code is stored in /data/dalvik-cache/ or alongside the APK as .odex, .vdex, and .art files. The .vdex file contains verified DEX code, the .odex file contains compiled native code, and the .art file contains pre-initialized heap images for faster startup.

Step 8: Permission Registration

The PackageManagerService registers the app's declared permissions and components with the system:

• Install-time permissions (like INTERNET or VIBRATE) are automatically granted without user interaction.
• Runtime permissions (like CAMERA or LOCATION) are registered but not granted. The app must request them at runtime.
• Intent filters are registered so the system knows which apps can handle which actions (like opening a URL or sharing content).
• Content providers are registered with their authorities so other apps can query them.

Step 9: System Integration

The final steps integrate the app into the Android system:

• Package database update: The system's package database (/data/system/packages.xml) is updated with the new app's information, including its assigned UID, permissions, and component declarations.
• Launcher notification: The home screen launcher is notified of the new app so it can display the app icon.
• Broadcast: The system sends a PACKAGE_ADDED broadcast, allowing other apps to react to the new installation (for example, backup apps might schedule a backup).
• SELinux context: The app's files are labeled with the appropriate SELinux security context based on its target SDK version and declared permissions.

Why Installations Fail

Understanding the installation pipeline helps diagnose common failures:

• "Parse error": The APK is corrupted, incomplete, or has a malformed manifest. This often happens with incomplete downloads or improperly converted files.
• "App not installed" (signature mismatch): You are trying to update an app with an APK signed by a different key. You must uninstall the existing version first.
• "Insufficient storage": Not enough space for the APK, extracted libraries, and DEX optimization output. The actual space needed is typically 2-3x the APK size.
• "Package conflicts with existing package": Same package name but different signature. Common when switching between Play Store and sideloaded versions.
• Version downgrade blocked: By default, Android prevents installing an older version over a newer one. ADB can override this with adb install -d.

Split APK Installation

When installing split APKs (from App Bundles), the process is slightly different. The system uses a session-based installation API:

1. A new installation session is created
2. Each split APK is written to the session
3. The session is committed, triggering the full verification pipeline
4. All splits must have matching package names, version codes, and signing certificates

This is the mechanism used by XAPK installers and tools like our APKS to APK merger to handle multi-file installations.APKS to APK merger

Installation via ADB

When you use adb install, the process bypasses the graphical installer but follows the same internal pipeline. ADB communicates with the package manager service through a socket connection. It supports additional flags that are not available through the GUI:

• -r: Replace existing app (allow reinstall)
• -d: Allow version downgrade
• -g: Grant all runtime permissions immediately
• -t: Allow installation of test-only APKs
• --install-multiple: Install split APKs in a single session

What Happens During Uninstallation

For completeness, here is what happens when an app is removed:

1. The app's processes are killed
2. The APK and extracted libraries are deleted from /data/app/
3. The app's private data directory is removed (unless the user chose to keep data)
4. Compiled DEX cache files are deleted
5. The package database is updated
6. A PACKAGE_REMOVED broadcast is sent
7. The launcher removes the app icon

Note that app-specific files on external storage (/Android/data/[package]/ and /Android/obb/[package]/) are also deleted on Android 10 and later, thanks to scoped storage enforcement.

Why Understanding PackageManager Saves Debugging Time

The Android installation process is a carefully orchestrated sequence of security checks, file operations, and system integrations. Each step serves a purpose, from protecting users against tampered apps to optimizing performance for the specific hardware. When installations fail, the error usually points to a specific step in this pipeline, and understanding the process helps you diagnose and resolve issues quickly.

Installing from the Play Store, sideloading an APK by hand, and pushing a build with ADB all funnel through the same underlying pipeline, the one that makes sure every app on your device has been verified, placed correctly, and optimized for your hardware.

How to Convert XAPK to APK: 7 Methods for Android, PC, Windows, Mac & Linux

If you've downloaded a game or app as an XAPK file and Android refuses to install it, you're not doing anything wrong. The file simply needs to be converted first. This guide covers 7 free methods to convert XAPK to APK, and they cover every situation we've run into: the browser-based converter when you just want the file fixed in a few seconds, ZArchiver when you'd rather do it by hand on your phone, and the command line on Windows, Mac or Linux when you're comfortable in a terminal. Start with Method 1; if your file is unusual, the later methods explain why.

Method 1: Convert XAPK to APK Online Free (Best Method)

If you just want this done quickly, the simplest way to convert XAPK to APK online is xapktoapk.com. It runs entirely in your browser, so there is nothing to download and nothing to install. You open the page, hand it the file, and get an APK back.xapktoapk.com

Steps to Convert XAPK to APK Online:

1. Open xapktoapk.com in any web browser (Chrome, Firefox, Safari, Edge)xapktoapk.com
2. Drag and drop your XAPK file, or click to browse and select it
3. The converter automatically extracts the APK from the XAPK package
4. Click Download APK to save the converted file

Because it is just a web page, this method works the same on Android, Windows, Mac and Linux; there is no separate app to install. In our own testing, files up to roughly 500 MB convert smoothly on a typical phone, and larger ones are happier on a desktop browser with more memory. Everything is processed locally on your device, so your file never leaves your computer.

Method 2: How to Convert XAPK to APK on Android

If you want to know how to convert XAPK to APK on Android or how to convert XAPK to APK on mobile, the easiest way is to use the browser-based converter right on your phone, and there is nothing to install:

1. Open Chrome, Firefox, or any mobile browser
2. Navigate to xapktoapk.com and tap the upload box.xapktoapk.com
3. Select your .xapk file from your phone's Downloads folder
4. Wait a few seconds for the client-side converter to merge and sign the APK
5. Tap Download APK and open the downloaded file to install

Method 3: How to Convert XAPK to APK on Windows PC

Whether you are using BlueStacks, LDPlayer, NoxPlayer, or Windows Subsystem for Android (WSA), you can convert XAPK packages right in your desktop browser using our Windows PC XAPK Converter guide.Windows PC XAPK Converter guide

Method 4: How to Convert XAPK to APK on Mac

The same browser-based converter works on macOS, including both Apple Silicon and Intel Macs:

1. Open xapktoapk.com in Safari, Chrome, or Firefox on your Mac.xapktoapk.com
2. Drag the .xapk file onto the upload area.
3. Download the resulting APK and transfer it to your Android device.

For more detail and a manual Archive Utility fallback, see the macOS guide.macOS guide

Method 5: How to Convert XAPK to APK on Linux

For Linux users, the best method is using the online XAPK to APK converter at xapktoapk.com. It works in any browser (Chrome, Firefox, Chromium) on any Linux distribution (Ubuntu, Fedora, Debian, Arch, etc.).xapktoapk.com

Alternatively, since XAPK is essentially a ZIP archive, you can manually extract it using the command line:

unzip -o yourfile.xapk -d extracted_xapk/
cp extracted_xapk/base.apk ./converted.apk

Method 6: How to Convert XAPK to APK Using ZArchiver

A popular method for Android users is using ZArchiver, a free file manager with archive support. Here's how to convert XAPK to APK using ZArchiver:

1. Download and install ZArchiver from Google Play Store
2. Navigate to the folder containing your XAPK file
3. Long-press the XAPK file and select "View" (not "Extract")
4. Look for the file named base.apk inside the archive
5. Long-press base.apk and select "Extract"
6. Choose a destination folder and confirm
7. Navigate to the extracted APK and install it

Method 7: Manual Extraction (Without Any Software)

You can also convert XAPK to APK without software by manually renaming and extracting the file:

1. Make a copy of your .xapk file
2. Rename the copy from .xapk to .zip
3. Extract the ZIP file using your system's built-in archive tool
4. Inside the extracted folder, find the base.apk file
5. This is your converted APK, ready to install on Android

Note: Can I rename XAPK to APK? No, simply changing the file extension from .xapk to .apk won't work. You need to extract the base.apk from inside the XAPK archive.

Inside an XAPK: What You Are Actually Converting

Before walking through error fixes, it helps to know what an XAPK contains. The file is a plain ZIP archive with a fixed internal layout. Renaming it to .zip and opening it reveals something close to this structure (sizes vary widely):

example.com.app.xapk
├─ base.apk                        ← the installable APK (always present)
├─ config.arm64_v8a.apk            ← native code for ARM 64-bit devices
├─ config.armeabi_v7a.apk          ← native code for ARM 32-bit devices
├─ config.xxhdpi.apk               ← high-density screen resources
├─ config.xxxhdpi.apk              ← extra-high-density screen resources
├─ config.en.apk                   ← English language pack
├─ config.fr.apk                   ← French language pack
├─ Android/obb/com.example/        ← OBB expansion data
│  └─ main.42.com.example.obb
├─ icon.png
└─ manifest.json                   ← XAPK-format metadata

The manifest.json at the top is what tells installer apps how to put everything together. It lists the package name, version, target SDK, and the full set of split APKs and OBBs that make up a complete install. Different XAPK producers use slightly different schemas; the most common version looks like this:

{
  "xapk_version": 2,
  "package_name": "com.example.app",
  "name": "Example App",
  "locales_name": { "en-US": "Example App" },
  "version_code": "42",
  "version_name": "1.0.42",
  "min_sdk_version": "24",
  "target_sdk_version": "34",
  "permissions": ["android.permission.INTERNET", "..."],
  "total_size": 738197504,
  "expansions": [
    { "file": "Android/obb/com.example.app/main.42.com.example.app.obb",
      "install_location": "EXTERNAL_STORAGE",
      "install_path": "Android/obb/com.example.app/main.42.com.example.app.obb" }
  ],
  "split_apks": [
    { "id": "base", "file": "base.apk" },
    { "id": "config.arm64_v8a", "file": "config.arm64_v8a.apk" },
    { "id": "config.xxhdpi",    "file": "config.xxhdpi.apk" }
  ]
}

"Converting an XAPK to APK" really means: pick the right combination of those split APKs for the target device, merge them into a single installable file, and (if there is OBB data) hand the user the OBB separately so it can be placed at /sdcard/Android/obb/<package>/.

How the Conversion Actually Works

Under the hood, every conversion method is doing one of three things, in increasing order of sophistication:

1. Extract-only ("rename and unzip")

The simplest case: the XAPK contains exactly one APK called base.apk and no splits. All the converter has to do is unpack the ZIP and hand base.apk to the user. This is what manual rename-to-.zip achieves and why method 7 in this guide works for many older XAPKs.

2. Split-aware extract

Modern XAPKs ship with multiple config.*.apk splits. Installing only base.apk on these XAPKs produces an app that launches but crashes the moment it tries to load native code or localized resources. A correct conversion either:

• Selects the right ABI / DPI / language splits for the target device and installs them together with install-multiple, or
• Merges all relevant splits into a single "universal" APK so you can install one file.

Our browser-based converter does the merge for you. The Android runtime treats the resulting single APK identically to the original split-installed app, except the package is bigger because it carries every ABI and DPI bucket together.

3. OBB-aware install

If the XAPK includes OBB expansion data, no APK on its own (merged or not) will run correctly until the OBB is in place. The conversion has two outputs in that case: the merged APK and a separate OBB file the user must place at the path /sdcard/Android/obb/<package>/<obb_filename>. Our OBB Extractor handles this.OBB Extractor

Method-by-Method Comparison

Each of the seven methods covered above is a real option, but they don't have the same properties. Here is a quick comparison so you can pick the right one without re-reading the whole article:

Methods 5, 6, and 7 (extract-only) are perfect for simple XAPKs and bad for split-heavy XAPKs. Methods 1–4 (the browser tool) are the only ones in this list that actually merge splits and produce a single universal APK that installs without a split-aware installer.

OBB Files: What to Do If the Game Won't Run After Conversion

If you converted an XAPK, installed the resulting APK, opened the app, and got a "downloading additional files" screen that immediately fails, or the app launches and crashes; the missing piece is almost certainly the OBB.

OBB ("Opaque Binary Blob") files are companion data files that Android apps load from /sdcard/Android/obb/<package>/. They are typically used for game asset bundles (textures, audio, level data) that are too large to fit inside the APK itself. Many large games distribute the APK and a 1–3 GB OBB together inside an XAPK; converting just the APK leaves the OBB behind.

How to install the OBB manually

1. Use our OBB Extractor on the original XAPK to pull the OBB file (or any of methods 5–7 above to extract it manually from the ZIP).OBB Extractor
2. The OBB will be named something like main.42.com.example.app.obb. The numbers represent the version code; the package name is the second part.
3. On the device, navigate to /sdcard/Android/obb/. Create the directory com.example.app if it does not exist (use the package name from the OBB filename).
4. Copy the .obb file into that directory. The full path should look like /sdcard/Android/obb/com.example.app/main.42.com.example.app.obb.
5. Launch the app. It will pick up the OBB automatically and skip the "additional download" screen.

On Android 11 and later, accessing Android/obb/ from a regular file manager requires the "All files access" permission. The cleanest workaround is to install via ADB (adb push main.42.com.example.app.obb /sdcard/Android/obb/com.example.app/), or to use a file manager that already holds the permission, such as the Files by Google app on Pixel-series devices.

Common Conversion Errors and How to Fix Them

"No base.apk inside the archive"

Either the file is not really an XAPK (it might be a misnamed APKM or APKS), or the XAPK uses an unusual layout. Try renaming the file to .zip and inspecting it: the install payload might be at splits/base-master.apk or com.example.app.apk instead of the expected base.apk. Our converter recognises the common variants automatically.

"Conversion completed but the app crashes immediately"

Almost always one of two things: missing native libraries (the XAPK had a separate config.arm64_v8a.apk that did not get merged) or missing OBB data. Re-run the conversion using a split-aware method (1–4) and double-check that the OBB was placed correctly.

"App not installed" after conversion

See our install-failure troubleshooting guide for the full set of causes. The most common one for converted XAPKs is signing-key mismatch with an existing install; if the same app is already on the device, uninstall it first.install-failure troubleshooting guide

"Conversion produces a 0-byte file"

Usually means the original XAPK was truncated (the download died before completion) or the archive's central directory is damaged. Re-download from the original source. If re-download is not possible, see how to recover from a corrupted APK.how to recover from a corrupted APK

"Browser becomes unresponsive on a 2 GB XAPK"

Browser-based ZIP libraries hold the archive in memory while merging splits. On a low-end laptop with limited RAM, very large XAPKs can exhaust the JavaScript heap. Workarounds: close other tabs, retry on a desktop with more memory, or use the Linux command-line method (unzip handles arbitrarily large files because it streams them).

Verifying the Converted APK Before You Install

Whatever method you used, run two quick checks before installing the result:

1. Signature integrity. Drop the converted APK into our APK Verifier. It will display the signing certificate fingerprint. Compare that fingerprint against the developer's known fingerprint (often published on the developer's site) or against the existing Play Store install of the same app, if you have it. A mismatch means the file has been altered since the developer signed it.APK Verifier
2. Permission audit. Pass the same APK through our APK Info tool and read the uses-permission entries. Ad-injected or trojanised re-uploads of legitimate apps often add SMS, contacts, or accessibility permissions that the original app does not request. See our permissions guide for the full list of what to look for.APK Info toolpermissions guide

Both tools run entirely in your browser; the file never leaves your device. The check takes about ten seconds and catches most "looks legit but is actually trojaned" cases.

When You Actually Need to Convert (and When You Don't)

It is worth knowing when the conversion step is genuinely necessary. You only need to convert XAPK to APK if:

• You want a single-file install on a device that does not have a split-APK installer.
• You want to inspect or audit the APK separately from its companion data.
• You want to copy a single APK to another device, archive it for later, or send it to a colleague for testing.

You do not need to convert if you simply want to install the XAPK on a device that already has a split-APK installer such as the open-source SAI. In that case, opening the XAPK in the installer takes care of split selection and OBB placement automatically, no conversion step required. The conversion approach is most useful precisely when no installer is available, when you want a permanent backup of the merged result, or when you are preparing the file for analysis.

Frequently Asked Questions

Can you convert XAPK to APK?

Yes. There are several ways to do it, and none of them are complicated. If you just want the file working, open xapktoapk.com in any browser and drop the XAPK in; it pulls out the installable APK without you having to install anything. The rest of this page covers the manual routes for when you would rather do it yourself.xapktoapk.com

Why XAPK not APK?

It usually comes down to size. Big games carry gigabytes of textures and audio that will not fit inside a single APK, so stores bundle the APK together with its OBB data and ship the whole thing as one XAPK. That is why titles like PUBG Mobile, Free Fire, and Call of Duty so often arrive in this format from third-party stores rather than as a plain APK.

Can I rename XAPK to APK?

No. Changing the extension does nothing useful. An XAPK is really a ZIP container with the APK tucked inside alongside its splits and OBB data, so the system still cannot read it as an installer. You have to open the archive and pull the APK out, either with xapktoapk.com or a file manager like ZArchiver.

What is XAPK and how to install?

XAPK is an extended package format that wraps an APK together with its extra data. There are two ways to get it onto a phone: convert it to a normal APK with xapktoapk.com and install that, or hand the XAPK to an installer that understands the format, such as the open-source SAI (Split APKs Installer). Our guide to installing XAPK on Android walks through both.guide to installing XAPK on Android

How to install XAPK without APKPure?

You are not tied to APKPure at all. Convert the file to an APK first with xapktoapk.com and install that the normal way, or extract the APK by hand with ZArchiver if you would rather not use a website. Either route gets you there without APKPure's own installer.xapktoapk.com

How to download XAPK to APK?

Head to xapktoapk.com, drop in your XAPK, and the page hands back the APK for you to save straight away. There is no sign-up, and because everything runs in the browser it works the same on a phone, a laptop, or anything else with a browser.xapktoapk.com

How to Install XAPK Files on Android

XAPK is a common way to hand out big Android apps, especially games. The catch is that you can't just tap one and watch it install the way a normal APK does. Android doesn't recognize the bundle on its own, so it needs a little help from you. Here are the ways to get an XAPK onto your phone, starting with the simplest.

Method 1: Convert to APK (Recommended)

The simplest method is to extract the APK from the XAPK file and install it separately:

1. 1

   Go to our XAPK to APK Converter

   Open XAPK to APK converter in your browserXAPK to APK converter

2. 2

   Select your XAPK file

   Drag and drop or click to select your XAPK file

3. 3

   Download the extracted APK

   Click the download button to get your APK file

4. 4

   Install the APK on your device

   Transfer the APK to your phone and install it

Method 2: Use an XAPK Installer App

Several apps can install XAPK files directly on your device:

Method 3: Manual Installation

For advanced users, you can manually install XAPK contents:

1. Rename the .xapk file to .zip
2. Extract the ZIP file
3. Install the base.apk file
4. Copy the OBB folder to /Android/obb/ on your device

Enabling Unknown Sources

Before installing any APK file, you need to enable installation from unknown sources:

Troubleshooting

If you encounter problems:

• "App not installed" - Check if you have enough storage space
• "Package corrupted" - Re-download the XAPK file
• App crashes after install - You may need the OBB files

Why Do Some Apps Use XAPK Format?

Google Play caps a single APK's compressed download size at 150MB (raised from the older 100MB limit). Games and large applications that exceed this limit use additional expansion files (OBB or split APKs). The XAPK format bundles the base APK together with these expansion files into a single downloadable package, making it easier for users to download everything they need in one file.

Many popular games like PUBG Mobile, Genshin Impact, Call of Duty Mobile, and Free Fire use XAPK format because their game assets exceed the APK size limit. When you install XAPK on Android, the installer automatically extracts both the APK and the OBB data files to their correct locations.

XAPK vs APK: What's the Difference?

Understanding the difference between XAPK and APK helps you choose the right installation method:

• APK (Android Package Kit) is the standard Android install file. It carries the app's code and its basic resources, and nothing else.
• XAPK (Extended APK) is really just a ZIP. Inside sits the base APK along with OBB expansion data or a set of split-APK configurations.
• File size is where the two part ways. An APK usually stays under 150MB, while an XAPK can run to several gigabytes for a big game.
• Installation differs too. An APK goes in with a single tap, whereas an XAPK needs a dedicated installer or a little manual extraction.

Tools to Install XAPK Files on Android (2026)

If you have a legitimate XAPK file (your own build, an open-source release from a project's own page, or an app you legally own), here are the typical tool categories used to install it on Android:

• SAI (Split APKs Installer) is the open-source pick for split-APK and XAPK packages. You'll find it on the project's GitHub releases and on F-Droid.
• The built-in package installer plus ADB suits developers. Running adb install-multiple base.apk split_*.apk handles split APKs directly, and any OBB data can be pushed afterwards with adb push.
• Manual extraction works when you'd rather not install anything extra. Rename the XAPK to .zip, open it with Android's file manager or any archive app, install base.apk, then move any OBB folder into /Android/obb/<package>/.
• This site's converter keeps the whole thing in the browser. xapktoapk.com pulls out a single installable APK locally, with nothing sent to a server.xapktoapk.com

Frequently Asked Questions

Advanced XAPK Installation Tips for 2026

Installing XAPK on newer Android versions

Recent Android releases have stricter Scoped Storage policies and tighter app verification. On Android 14, 15, and 16 you may need to grant additional permissions through your file manager before sideloading. The simplest workflow is to use the online converter to extract a single APK and install that normally.online converter

Using ADB to install

For developers, ADB is a quick path. After renaming the XAPK to .zip and extracting it, run adb install-multiple base.apk split_config.*.apk when there are split APKs, or adb install base.apk for a single base APK. If the package ships with OBB data, push it afterwards with adb push main.obb /sdcard/Android/obb/<package>/.

Where to obtain a trustworthy XAPK installer

For installer apps themselves (SAI being the most widely used open-source option), prefer the project's own release page or a well-known open-source repository such as F-Droid. Whichever you pick, run the installer's APK file through the signature verifier before installing, and avoid unknown third-party sites that re-host installers without provenance.signature verifier

Working with APKM files

The .apkm format used by APKMirror is closely related to XAPK. You can rename a .apkm to .zip and extract the base APK manually, or feed it to the APKS merger, which also handles APKM bundles by merging split APKs into a single installable file.APKS merger

BlueStacks 5 vs LDPlayer 9 vs MuMu Player 12: XAPK Emulator Benchmark & Windows 11 Guide (2026)

Executive Summary: Following Microsoft's retirement of Windows Subsystem for Android (WSA), running Android packages on Windows 10 and Windows 11 relies on hardware-virtualized emulators like BlueStacks 5 (Android 11 64-bit), MuMu Player 12 (Android 12 64-bit), and LDPlayer 9 (Android 9 64-bit). While most modern emulators include a sidebar Install APK/XAPK button, multi-split .xapk archives frequently trigger INSTALL_FAILED_NO_MATCHING_ABIS or sidebar parsing failures unless matched to a 64-bit ARM-translated instance or pre-merged into a standalone .apk.

1. 2026 Windows Android Emulator XAPK Compatibility Benchmark

We tested five major Windows 10/11 Android emulators using a 450 MB multi-split .xapk (containing base.apk + config.arm64_v8a.apk + config.xxhdpi.apk) and a 1.2 GB .xapk with an external .obb expansion file:

2. Step-by-Step: The Bulletproof Way to Install Any XAPK on BlueStacks 5, LDPlayer 9, or MuMu 12

Whenever dragging a raw .xapk onto your emulator window shows "Unfortunately, this app could not be installed" or "APK Parse Error", follow this 3-step workflow on your Windows PC:

1. Inspect the Required Android API & ABI First: Drop your .xapk into our XAPK File Viewer or Device Compatibility Checker. If the package requires Android 10+ (API 29+), it will never install on LDPlayer 9 (which runs Android 9 / API 28)—you must open BlueStacks Multi-Instance Manager and create an Android 11 64-bit instance, or use MuMu Player 12 (Android 12).XAPK File ViewerDevice Compatibility Checker
2. Convert the Split XAPK into a Single Universal APK: Drop the .xapk file into the XAPK to APK Converter in Chrome or Edge on your PC. Our browser merger patches AndroidManifest.xml, combines all ABI and DPI configuration splits, 4-byte zipaligns resources.arsc, and signs the output with v1+v2 signatures.XAPK to APK Converter
3. Install the Converted APK & Copy Any OBB File: Press Ctrl + Shift + B in BlueStacks (or click the Install APK sidebar icon in LDPlayer/MuMu) and select the converted .apk. If your XAPK also contained an .obb expansion file, extract it with our OBB File Extractor and drop it into the emulator's shared folder, then move it to /sdcard/Android/obb/<package_name>/ using the emulator's Media Manager.OBB File Extractor

3. Fixing Common Emulator Error Codes

• "Incompatible with current instance (64-bit required)": Open BlueStacks Multi-Instance Manager → Fresh Instance → select Android 11 64-bit (or Pie 64-bit) and set ABI setting to ARM 32-bit & 64-bit.
• Black/Pink Textures on Game Launch: Either the .obb file was not copied to /sdcard/Android/obb/<package_name>/, or the emulator's graphics renderer needs to be switched from OpenGL to Vulkan under Emulator Settings → Graphics.

How to Open and Install XAPK Files on Chromebook (ChromeOS) & Linux (Waydroid)

Modern Chromebooks run Android applications inside Google's ARCVM (Android Runtime for Chrome Virtual Machine), while Linux desktop and handheld users (including Ubuntu, Fedora, Arch, and SteamOS) run full Android environments using Waydroid. Because neither ChromeOS's Files app nor Waydroid's default waydroid app install CLI accepts raw .xapk containers directly, you need either a clean browser-merged .apk or a multi-split ADB deployment through the Linux terminal.

1. Converting XAPK to APK on ChromeOS & Linux in the Browser

Since ChromeOS and Linux desktops include a full desktop Chromium/Firefox browser with generous RAM, you can convert any .xapk or .apks bundle directly in your browser without installing any extra Linux packages:

1. Open xapktoapk.com in Chrome on your Chromebook or Linux machine.xapktoapk.com
2. Drop your .xapk archive onto the converter. It merges the base APK with its companion architecture and DPI configuration splits and signs the output package with v1+v2 signatures.
3. Download the standalone .apk file to your Linux files directory on ChromeOS (or ~/Downloads on Linux).

2. Installing the Converted APK on Chromebook (Without Wiping Your Device)

Older guides tell Chromebook users to put their entire laptop into insecure "Developer Mode" (which powerwashes the device). On modern ChromeOS, you do not need full Developer Mode—you only need the built-in Linux Development Environment (Crostini):

1. Open Settings → About ChromeOS → Developers and turn on Linux development environment.
2. Under the same Developers menu, click Develop Android apps and toggle on Enable ADB debugging (your Chromebook will restart once to link Crostini to ARCVM).
3. Open the Linux Terminal app on your Chromebook and install the Android ADB client:

   sudo apt update && sudo apt install -y android-sdk-platform-tools-common adb

4. Connect to the internal ARCVM Android bridge (100.115.92.2:5555) and install your converted APK:

   adb connect 100.115.92.2:5555
   adb install ~/merged_app.apk

3. Installing XAPK Bundles on Linux Desktops & Steam Deck via Waydroid

If you run Waydroid on Ubuntu, Fedora, Arch Linux, or a Steam Deck, waydroid app install only accepts a single monolithic .apk file:

• Single Merged APK Route (Fastest): Convert your .xapk into a single .apk using our online XAPK to APK Converter, then run:

  waydroid app install ~/Downloads/converted_app.apk

  online XAPK to APK Converter
• CPU Architecture Check (x86_64 vs arm64-v8a): Intel and AMD Chromebooks and Linux PCs run an x86_64 processor. While ChromeOS ARCVM includes Intel Houdini binary translation for ARM apps, Waydroid on Linux requires you to install libndk or libhoudini via waydroid_script if the XAPK only contains arm64-v8a native libraries. Use our Device ABI & DPI Compatibility Checker to inspect which lib/ folders your package contains before installing.Device ABI & DPI Compatibility Checker

4. Unpacking XAPK Archives from the Linux Command Line

If you prefer inspecting the raw contents of an .xapk archive in bash/zsh on Linux before deploying via ADB, remember that .xapk is a standard PKZIP container:

mkdir -p /tmp/xapk_unpack && unzip -q package.xapk -d /tmp/xapk_unpack
cat /tmp/xapk_unpack/manifest.json | jq .
adb install-multiple /tmp/xapk_unpack/*.apk

Summary for ChromeOS & Linux Developers

By combining ChromeOS's built-in Crostini ADB bridge (or Linux Waydroid) with browser-based XAPK conversion, you can test and run multi-split Android packages on desktop hardware without modifying system partitions or installing untrusted third-party unpackers.

How to Convert and Install XAPK Files on Amazon Firestick, Android TV & Google TV

Sideloading an Android TV build or utility onto an Amazon Fire TV Stick, Chromecast with Google TV, or NVIDIA Shield TV works smoothly when you have a standard .apk file. However, if the build you exported or backed up is packaged as a multi-split .xapk or .apkm bundle, two immediate roadblocks appear on a television screen: the built-in TV package installer refuses to open .xapk files, and most phone-oriented XAPK installer apps are impossible to navigate with a 5-button D-pad remote.

1. Why Split XAPK Installers Fail on Television Interfaces

Smart TVs and streaming sticks running Android TV, Google TV, or Fire OS (Fire OS 7 based on Android 9 and Fire OS 8 based on Android 11) differ from phones in three critical ways:

• Limited On-Board Flash Storage: A typical Fire TV Stick 4K or Chromecast with Google TV has only 4 GB to 8 GB of usable user storage. Unpacking a 900 MB .xapk archive on the TV itself requires nearly 2.7 GB of temporary free space (the original archive + extracted splits + installed package).
• 32-Bit Operating System Mode on Many Streaming Sticks: Even though the MediaTek processor inside most Fire TV Stick 4K models is 64-bit capable, Fire OS runs in 32-bit armeabi-v7a mode to conserve RAM. If your .xapk only includes config.arm64_v8a.apk splits, the TV will reject it with INSTALL_FAILED_NO_MATCHING_ABIS. You can verify which ABI splits are inside your package beforehand using our Device ABI & DPI Compatibility Checker.Device ABI & DPI Compatibility Checker
• No Touch Input for Touchscreen Dialogs: Third-party phone installers often place confirmation buttons in corners unreachable by a TV remote D-pad without a virtual mouse toggle.

2. Method 1: Convert XAPK to a Single APK on Your Phone or PC First (Recommended)

Because streaming sticks have tight storage and RAM ceilings, performing the split-APK merge on your phone, Windows PC, or Mac before sending the finished .apk to the TV is by far the fastest and cleanest workflow:

1. Open the XAPK to APK Converter on xapktoapk.com on your phone, laptop, or desktop browser.XAPK to APK Converter on xapktoapk.com
2. Drop your .xapk or .apks archive onto the converter. The engine merges the base APK, CPU architecture libraries, and TV density resources (xhdpi / tvdpi), patches the binary isSplitRequired flag, and signs the output with v1 + v2 signatures.
3. Download the resulting single .apk file.
4. Transfer the single .apk to your Firestick or Android TV over your home Wi-Fi using Send Files to TV (available on the official Play Store and Amazon Appstore) or a local HTTP file share, then click it once to install with the native TV Package Installer.

3. Method 2: Deploy Split APKs Directly Over Wi-Fi Using Wireless ADB

If you are a developer testing an unmerged split bundle or an app that includes an Android/obb/ asset pack on a Firestick or Google TV device, you can install all splits in a single transaction from your computer over Wi-Fi:

1. Enable ADB Debugging on Firestick / Google TV: On Fire TV, navigate to Settings → My Fire TV → Developer Options (if hidden, click your device name 7 times under About) and turn on ADB Debugging. On Google TV, enable USB / Wireless Debugging under Settings → System → Developer Options.
2. Unpack the XAPK Splits: Drop your .xapk into our XAPK Archive Viewer or APKM Unpacker to extract the split .apk files to a folder on your computer.XAPK Archive ViewerAPKM Unpacker
3. Connect and Run adb install-multiple: Open Terminal or PowerShell on your computer and run:

   adb connect 192.168.1.50:5555
   adb install-multiple base.apk config.armeabi_v7a.apk config.xhdpi.apk

4. Hardware Architecture Reference for Popular TV Devices

Choosing the Best Deployment Workflow for Your TV

For 95% of television setups, converting the .xapk into a single standalone .apk on your phone or computer before transferring it over Wi-Fi saves gigabytes of scarce TV flash storage and eliminates remote-navigation headaches. Always verify that the package supports your streaming device's CPU architecture (especially armeabi-v7a on Fire TV sticks) and carries a valid signature before sideloading.

Can You Install XAPK or APK on iPhone & iPad (iOS)? XAPK vs IPA Technical Guide (2026)

Direct Answer: No—you cannot install or run an Android .xapk or .apk file natively on an iPhone or iPad. Android packages contain Dalvik/ART bytecode (classes.dex) and Linux ELF native libraries (.so) designed for the Android Runtime, whereas Apple's iOS and iPadOS run the Darwin/XNU kernel and require Mach-O executables packaged inside an Apple-signed .ipa archive. However, you can open, inspect, unpack, and convert .xapk files inside Safari on iOS using browser-based tools to prepare them for an Android phone, Android TV, or VR headset.

1. Why Android XAPK/APK Cannot Run on Apple iOS: Binary Architecture Comparison

Even though modern iPhones (Apple A-series) and Android flagships (Snapdragon / Tensor / Dimensity) both use 64-bit ARMv8/ARMv9 processors, their operating system kernels, executable formats, system call tables, and UI frameworks are completely incompatible:

2. Security Warning: Avoid Fake "XAPK to IPA Converter" Websites

Because thousands of users search for "XAPK to IPA converter online" every day, deceptive websites frequently advertise tools claiming to convert any Android game into an iPhone app. From a software engineering standpoint, automatic binary translation of a full Android app (with its Binder IPC calls, Jetpack libraries, and Vulkan shaders) into an Apple-signed Mach-O .ipa is impossible without the developer's original Unity, Unreal, or Flutter source project.

What fake converters actually do:

• Prompt you to install an untrusted iOS Configuration Profile (.mobileconfig) under Settings → General → VPN & Device Management, which can hijack your browser bookmarks, DNS routing, or home screen web clips.
• Trap you in endless "human verification" ad-survey loops without ever delivering a working file.

3. What You CAN Legitimately Do with XAPK Files on iPhone or iPad

While you cannot execute an Android app on iOS, designers, QA testers, and multi-device users frequently download or inspect .xapk files on an iPhone or iPad for valid workflows:

1. Inspect Contents & Validate Manifests in Safari: Open our XAPK File Viewer & Validator in Safari on iOS/iPadOS to browse every file inside an .xapk archive, inspect manifest.json, and extract specific assets locally in browser memory.XAPK File Viewer & Validator
2. Extract High-Resolution App Icons for UI/Design Reference: Use our APK Icon Extractor on your iPad or iPhone to pull xxxhdpi PNG and vector icons directly to your Apple Photos or Files app.APK Icon Extractor
3. Convert XAPK to Universal APK on iPhone & Send to Android TV / Firestick: Many users own an iPhone alongside an Amazon Fire TV Stick, Chromecast with Google TV, or Meta Quest 3 headset. You can convert an .xapk into a standalone .apk right inside Safari using our XAPK to APK Converter, save the .apk to the iOS Files app, and beam it to your Android TV using apps like Send Files to TV or local HTTP sharing.XAPK to APK Converter

4. Legitimate Ways to Play Cross-Platform Titles on iOS

• Check the Official Apple App Store First: Most major Unity and Unreal titles distributed as XAPK on Android also have official iOS releases on the Apple App Store with cross-save account synchronization.
• Authorized EU Alternative App Marketplaces (iOS 17.4+ / iOS 18): If you are in the European Union, Apple supports notarized third-party iOS marketplaces (such as Epic Games Store for iOS and AltStore PAL), which distribute native, Apple-notarized iOS builds—never raw Android APKs.

How to Sideload XAPK Bundles and OBB Assets on Meta Quest 2, Quest 3 & Quest 3S

Meta Quest standalone VR headsets (Quest 2, Quest Pro, Quest 3, and Quest 3S) run Meta Horizon OS, which is built on 64-bit Android (arm64-v8a). Whether you are testing your own Unreal Engine / Unity VR build packaged with an OBB asset file or sideloading a legitimate 2D Android utility into your headset's Unknown Sources library, SideQuest and ADB cannot install a raw .xapk archive directly without first separating or merging its internal components.

1. Hardware Requirements on Meta Horizon OS (64-Bit ARM Only)

The Qualcomm Snapdragon XR2 Gen 1 (Quest 2) and Snapdragon XR2 Gen 2 (Quest 3 / Quest 3S) run a strict 64-bit Android userland. Before attempting to sideload any package:

• Ensure the package contains arm64-v8a native libraries (or is pure Java/Kotlin bytecode). You can verify this in two seconds by dropping your file into our Device ABI & DPI Compatibility Checker.Device ABI & DPI Compatibility Checker
• Ensure Developer Mode is enabled in the Meta Horizon mobile companion app under Menu → Devices → Headset Settings → Developer Mode.

2. Converting Split XAPK Utilities for SideQuest Installation

If your .xapk is a split-APK bundle (containing base.apk, config.arm64_v8a.apk, and config.xxhdpi.apk):

1. Open the XAPK to APK Converter on your PC, Mac, or directly inside the Meta Quest Browser.XAPK to APK Converter
2. Drop the .xapk file to merge all splits into a single v1+v2 signed .apk file.
3. In SideQuest (Advanced Installer) on your PC or Mac, click the Install APK file from folder on computer icon in the top bar and select the converted .apk.

3. Deploying VR Builds That Include an OBB Expansion File

Many standalone VR experiences and Unity builds keep their compiled code in base.apk and store 3D textures and audio banks inside a `main...obb` expansion file. If you install only the APK, the headset will stay on an infinite three-dot loading screen.

1. Extract Both APK and OBB: Drop your .xapk bundle into our OBB File Extractor or XAPK Archive Viewer to download both the .apk and the .obb file to your computer.OBB File ExtractorXAPK Archive Viewer
2. Install the APK & Push the OBB via ADB or SideQuest: Connect your Quest headset via USB-C and run these two commands from your terminal:

   adb install base.apk
   adb shell mkdir -p /sdcard/Android/obb/com.studio.vrapp/
   adb push main.100.com.studio.vrapp.obb /sdcard/Android/obb/com.studio.vrapp/

Launching Sideloaded Apps Inside Meta Horizon OS

Once installed, open your universal menu inside the headset, open the App Library, click the filter dropdown in the top-right corner (or the left sidebar on newer Horizon OS builds), and select Unknown Sources. Standard 2D Android utilities will automatically open inside a floating, resizable curved window in your home environment.

APKS to APK: How to Merge Split APKs for Easy Installation

If you've been downloading Android apps from alternative sources like APKMirror or APKPure, you've likely come across the .apks file extension. Unlike a traditional APK, these files are "Split APKs," a modern way Android manages app installation efficiently. However, they can be a headache to install on devices that don't support them natively.

Below we'll go over what APKS files actually are, why Android uses them, and the part most people came here for, how to merge APKS into a single APK you can install anywhere, using our APKS to APK online tool.APKS to APK online tool

What are Split APKs (APKS)?

Split APKs were introduced alongside Android App Bundles (AAB). Before this, developers had to create massive "fat" APKs that contained resources for every possible screen size, language, and CPU architecture (ARM, x86, etc.).

With Split APKs, the app is broken down into several parts:

• Base APK: Contains the main logic and functionality of the app.
• Config APK (Density): Contains images for specific screen resolutions (hdpi, xhdpi, etc.).
• Config APK (Language): Contains translations for a specific language.
• Config APK (ABI): Contains native libraries for specific processors.

An APKS file is simply a container (usually a ZIP archive) that holds all these individual splits.

Why Merge APKS to a Single APK?

While Split APKs are great for saving bandwidth, they are difficult to manage for sideloading because:

1. Standard Installers Fail: The default Android Package Installer can only install one APK at a time.
2. Portability: A merged APK is a single file that works on any device (provided you merge all splits).
3. Compatibility: Older Android versions (pre-Lollipop) or certain custom ROMs may struggle with splits.
4. Backup Ease: Keeping one file is simpler than managing 5-10 split pieces.

How to Merge APKS Online (The Easy Way)

The fastest way to handle these files is using our browser-based APKS tool. Here is how it works:

Steps to Merge:

1. Go to our APKS to APK Converter.APKS to APK Converter
2. Upload your .apks file into the secure upload zone.
3. Our tool will analyze the bundle and identify the base APK and necessary configuration splits.
4. It extracts the components directly in your browser, your files are never uploaded to a server!
5. Download the final merged .apk file or the main installation unit.

Method 2: Using the SAI (Split APKs Installer) App

If you prefer to install directly on your Android phone, SAI is the gold standard application. It is open-source and available on F-Droid and Play Store.

How to use SAI:

• Open SAI and grant it storage permissions.
• Click "Install APKs" and select your .apks file from your downloads.
• SAI will automatically pick the splits that match your phone's hardware.
• Click Install.

APKS vs XAPK: What's the Difference?

While they look similar, they serve different purposes:

Common Issues When Merging APKS

Sometimes merging splits can result in a broken app. Here is why:

• Missing Base APK: Without the base, the app won't start.
• Architecture Mismatch: If you only include ARMv7 splits but try to run on an ARMv8 device.
• Signature Breakage: Modifying splits can sometimes invalidate the app signature, preventing installation.

Note: For security, we recommend using the signature verifier tool to check your final file.

Verifying Your Merged Standalone APK Before Sideloading

Moving from APKS to APK is the most reliable way to keep your favorite apps portable and easy to install. Some people prefer an online tool like ours for privacy; others like an on-device app such as SAI for convenience. Either route works, and understanding split components is what puts you in full control of your Android experience.

How to Evaluate APK Sources Safely: A Security Checklist

If you sideload Android apps for legitimate reasons, installing a beta build supplied by the developer, reinstalling an open-source app whose project hosts its own releases, or restoring a backup of an app you legally own, you should always verify the file before installing it. This guide explains the technical signals that distinguish a trustworthy APK from a tampered one, without naming or promoting any specific download platform.

1. Start with the Most Trusted Source

For almost every user, the answer is the Google Play Store. Apps distributed there are signed by their original developers, scanned by Google Play Protect, and policed for malicious behaviour. If an app you want is on Play, install it from there, full stop.

The legitimate exceptions to the "Play first" rule are narrow:

• The application is open-source and the project distributes signed builds from its own official site, GitHub Releases page, or self-hosted update server.
• You are a developer testing your own internal builds.
• You are restoring an APK you exported from a device you own.
• The publisher distributes a region-specific or beta build directly from their official domain (and you can confirm the domain matches the developer's verified branding).

Anything outside those cases, and especially "free" copies of paid apps, should be treated as high-risk and is almost always a copyright violation.

2. Verify the Digital Signature

Every APK is cryptographically signed by its publisher. If the signature on a file does not match the publisher's known signing certificate, the file has been altered and must not be installed. Even a single malicious byte injected into an APK will invalidate the signature.

What to look for:

• v2/v3/v4 signature scheme present (modern Android requires it).
• Certificate fingerprint (SHA-256) matches a fingerprint published by the developer or matches a previously-installed copy of the same app.
• The certificate is not expired and the signing chain is intact.

You can run this check entirely offline using our APK Verifier: drag the .apk in, see the signing certificate and SHA-256 fingerprint, and compare it to the value the developer publishes.APK Verifier

3. Compare the SHA-256 Hash

A SHA-256 hash is a fixed 64-character fingerprint of the file's contents. If even one byte changes, the hash changes completely. Reputable developers publish the SHA-256 of every release alongside the download.

Process:

1. Compute the SHA-256 of the APK on your machine (most operating systems include a sha256sum or equivalent command; you can also use our APK Verifier).
2. Compare it character-by-character to the value published by the developer on their official site.
3. If the values match, the file is byte-identical to what the developer released. If they differ, do not install.

4. Review the Manifest and Permissions Before Installing

Android's permission system is your last line of defence. Before you install anything from outside the Play Store, open the package with our APK Info tool and read the manifest. Watch for:APK Info

• Disproportionate permissions. A simple offline calculator does not need SMS, contacts, accessibility-service, or device-admin access. Anything that asks for far more than its job requires is suspicious.
• Accessibility Service abuse. Malware frequently abuses BIND_ACCESSIBILITY_SERVICE to read screen content and click buttons on the user's behalf. Grant this only to apps you trust and that genuinely need it (screen readers, password managers, etc.).
• Device administrator / Device owner. Almost no consumer app legitimately needs this. If a sideloaded app requests it, stop.
• Mismatched package name. If the package name (e.g., com.example.app) does not match the genuine app's package, the file is impersonating a real product.
• Unfamiliar exported components. Activities, services, or broadcast receivers that are exported and look out of place can be a backdoor.

5. Red Flags Common to Untrustworthy Sources

Whether a source is a website, a chat group, or an email attachment, treat it as untrustworthy if you see any of the following:

• Free copies of paid apps or "premium unlocked" versions of commercial applications. These are pirated, often modified, and frequently carry malware.
• "Mod" or "cracked" branding. Modified APKs by definition fail signature verification and may contain anything the modder added.
• Multiple confusing "Download" buttons that turn out to be ads.
• Aggressive popups, fake "virus detected" alerts, or forced redirects.
• No HTTPS. If the source is not served over an encrypted connection, your download can be silently swapped in transit.
• No publisher information, no signing details, no changelog. A legitimate release has all of these.
• Pressure to disable Play Protect or to grant accessibility / device-admin "to make it work."

6. After Installing: Keep Watch

Verification is not a one-time event. After a sideloaded install:

• Leave Google Play Protect enabled. It scans installed packages periodically.
• Watch for unexpected battery drain, network use, or pop-up overlays, classic malware signatures.
• Periodically open Settings → Apps and review any apps you no longer use; uninstall them.
• If an app updates itself outside the Play Store, check that the new build's signature matches the previously-installed one. A mismatch is an emergency.

7. What This Site Does (and Does Not) Provide

XAPK to APK is a set of browser-based file-format converters and inspectors. We do not host APK files, we do not link to APK download sites, and we do not facilitate piracy. Every tool on this site processes files locally in your browser, no upload, no copy, no retention. See our Disclaimer and Privacy Policy for full details.DisclaimerPrivacy Policy

Golden Rules for Verifying Third-Party APK Downloads

Sideloading is a legitimate and powerful capability of the Android platform, but it shifts security responsibility from Google's reviewers onto you. By sticking to the official Play Store for paid and consumer apps, restricting sideloading to first-party developer releases of software you already legally have access to, and verifying the signature and hash of every package before installing, you can enjoy that flexibility without compromising security or breaking the law.

How to Sideload APK Files Safely on Android

Sideloading, the process of installing APK files from sources outside the Google Play Store, can be useful, but it also comes with security risks. The walkthrough below shows how to sideload APK files safely while protecting your device from malware and other threats.

What is APK Sideloading?

Sideloading refers to installing an application on your Android device using an APK file that wasn't downloaded from the official Google Play Store. Common reasons people sideload include:

• Regional restrictions: Some apps aren't available in certain countries
• Older versions: You may need a previous version of an app
• Beta testing: Developers distribute beta APKs for testing
• Modified apps: Open-source apps or custom builds
• App removed from Play Store: Apps that are no longer listed

Step 1: Enable Installation from Unknown Sources

Before you can sideload an APK, you need to allow your device to install apps from unknown sources:

Android 8.0+ (Oreo and newer)

1. Go to Settings → Apps & Notifications
2. Tap Special app access (or Advanced)
3. Tap Install unknown apps
4. Select the app you'll use to install (e.g., Chrome, File Manager)
5. Toggle Allow from this source ON

Android 7.0 and earlier

1. Go to Settings → Security
2. Toggle Unknown sources ON
3. Confirm the warning prompt

Step 2: Use Legitimate Sources Only

The most important safety measure is restricting sideloading to legitimate sources. Acceptable sources include:

• The official Google Play Store, the safest and most appropriate option for the vast majority of apps.
• The application developer's own website, many publishers (browsers, messengers, games, productivity apps) host their installers and beta builds directly.
• Project release pages for open-source software, for example, GitHub or GitLab releases for an OSS project's signed build artifacts.
• F-Droid, a community-run repository that builds free and open-source apps from their public source code, providing strong provenance for OSS-only software.
• Your own backups, APKs you legally exported from a device you own.

Avoid any source that offers paid apps for free, "modded" or "cracked" copies of commercial software, or unsigned re-uploads of apps from someone other than the publisher. These almost always violate copyright and frequently carry malware.

Step 3: Verify the APK Before Installing

Before installing any sideloaded APK, take these precautions:

1. Check the file size: Compare it with the known size of the app
2. Verify the signature: Use our APK Verifier tool to check if the APK has a valid signatureAPK Verifier tool
3. Check permissions: Use our APK Info tool to review what permissions the app requestsAPK Info tool
4. Scan with antivirus: Use Google Play Protect or another antivirus to scan the file

Step 4: Install the APK

1. Locate the downloaded APK file (usually in the Downloads folder)
2. Tap on the APK file
3. Review the permissions requested
4. Tap Install
5. Wait for the installation to complete
6. Tap Open or Done

Red Flags to Watch For

Avoid installing an APK if you notice any of these warning signs:

• 🚩 The APK requests unusually many permissions (e.g., a calculator app asking for camera access)
• 🚩 The file size is significantly different from the official app
• 🚩 The source website looks suspicious or has many pop-up ads
• 🚩 The APK was shared via messaging apps or social media from unknown people
• 🚩 Your antivirus flags the file as potentially harmful
• 🚩 The APK signature doesn't match the original developer's signature

After Installing: Post-Installation Safety

• Disable unknown sources: After installing, go back and disable the permission
• Monitor app behavior: Watch for unusual battery drain, data usage, or ads
• Keep Play Protect enabled: Google Play Protect can scan sideloaded apps too
• Update regularly: Check for updates from the trusted source where you got the APK

Staying Safe When Installing Apps Outside Google Play

Sideloading APK files can be safe when done correctly. The key is to restrict it to legitimate sources, preferably the official Play Store, the developer's own website, an open-source project's own release page, or your own backups, verify each APK before installing, and keep your device's built-in security features (Play Protect, signature verification) enabled. By following this guide, you can use the flexibility of sideloading without compromising your device's security.

Sideloading, the practice of installing apps from sources other than the official app store, has been a core feature of Android since its earliest days. Unlike iOS, which historically restricted installations to the App Store, Android has always given users the freedom to install software from any source they choose. In 2026, sideloading remains relevant for millions of users worldwide, but how you do it, and how Android polices it, has changed a lot along the way.

What follows is the practical side of doing it safely on a modern device: how the install actually works, how to tell a clean APK from a tampered one, and the handful of habits that keep malware off your phone.

Why People Sideload Apps

It is worth starting with the reasons, because most of them are perfectly ordinary. People sideload for all sorts of legitimate purposes:

• Regional restrictions: Some apps are only available in certain countries on the Play Store. Users in other regions may need to sideload to access them.
• Device compatibility: The Play Store sometimes marks apps as incompatible with certain devices, even when they work perfectly fine. Sideloading bypasses these artificial restrictions.
• Beta testing: Developers often distribute pre-release builds as APK files for testing outside of official channels.
• Open-source apps: Many open-source projects distribute their apps directly as APKs from their websites or GitHub repositories, independent of any app store.
• No Play Store access: Some devices (like certain Amazon tablets, Chinese market phones, or custom ROMs) do not include Google Play Services. Sideloading is the primary installation method on these devices.
• Older app versions: Sometimes an app update introduces bugs or removes features. Sideloading an older version lets you roll back to a working state.
• Enterprise distribution: Companies often distribute internal apps to employees via sideloading rather than publishing them on public app stores.

Understanding Unknown Sources

Android's "Unknown Sources" setting is the gatekeeper for sideloading. Its implementation has changed significantly across Android versions:

Android 7.1 and Earlier

On older Android versions, "Unknown Sources" was a single global toggle found in Settings → Security. Enabling it allowed any app to install APKs from any source. This was an all-or-nothing approach with obvious security implications, once enabled, any app could silently trigger installations.

Android 8.0 to Present

Starting with Android 8.0 (Oreo), Google replaced the global toggle with per-app permissions. Instead of a single switch, each app that wants to install APKs must be individually granted the "Install unknown apps" permission. This is found in Settings → Apps → Special app access → Install unknown apps.

This granular approach is much more secure. You can allow your browser to install downloaded APKs while preventing other apps from doing so. After installing an app, it is good practice to revoke the permission from the source app until you need it again.

Android 13+ Restricted Settings

Android 13 introduced an additional layer called "Restricted Settings." Apps installed from sideloading sources are initially blocked from accessing certain sensitive permissions (like Accessibility Services and Notification Listener). To grant these permissions, users must go through an extra confirmation step in settings. This protects against malware that tricks users into granting powerful permissions.

How to Sideload an APK: Step by Step

Here is the basic process for sideloading an app on a modern Android device:

1. Download the APK file from a legitimate source to your device. It will typically land in your Downloads folder.
2. Open the file. Tap the downloaded APK in your notification shade or find it using a file manager.
3. Grant permission if prompted. If the source app (browser or file manager) does not have install permission, Android will prompt you to grant it. Tap "Settings" and enable the toggle.
4. Review the installation screen. Android shows the app name, and on older versions, the permissions it requests. Tap "Install."
5. Wait for installation. The system verifies the APK, extracts files, and optimizes the code. This usually takes a few seconds.
6. Open or Done. Once complete, you can launch the app immediately or return to what you were doing.

Verifying APK Integrity and Safety

The most important aspect of sideloading is ensuring the APK you are installing is legitimate and has not been tampered with. Here are the verification methods available to you:

Check the SHA-256 Hash

Reputable sources publish the SHA-256 hash of their APK files. Before installing, you can compute the hash of your downloaded file and compare it to the published value. If they match, the file has not been modified in transit. On Android, apps like Hash Checker can compute file hashes. On a computer, use sha256sum (Linux/Mac) or certutil -hashfile (Windows).

Verify the Signing Certificate

Every legitimate APK is signed with the developer's private key. By checking the signing certificate, you can confirm that the APK was built by the expected developer. Our APK Verifier tool lets you upload an APK and instantly see its signing certificate details, including the SHA-256 fingerprint of the certificate.APK Verifier tool

For well-known apps, you can compare the certificate fingerprint against the known-good value published by the developer. Each app is signed with its developer's own private key, and that signature stays consistent across every update of the app. So if someone distributes a "Google Maps" APK whose certificate does not match the official one, it is not the genuine app.

Google Play Protect Scanning

Even when sideloading, Google Play Protect (if available on your device) scans APKs before and after installation. It checks against Google's database of known malware. While not foolproof, this provides an additional layer of protection. You can manually trigger a scan in Play Store → Profile → Play Protect.

Check Permissions

Before installing, review what permissions the app requests. A simple calculator app requesting access to your contacts, camera, and SMS is a red flag. While Android's runtime permission model means the app cannot access these without your explicit approval, excessive permission requests suggest the app may not be trustworthy.

Where to Get APKs Legitimately

Where you get your APKs is half the battle. The sources worth trusting tend to fall into a few groups:

• Official developer websites: Apps like Signal, F-Droid, and Firefox distribute APKs directly from their official sites. These are the most trustworthy sources.
• GitHub releases: Open-source projects often publish signed APKs as GitHub release assets. You can verify the source code matches the binary.
• Established repositories: Sites with long track records, transparent policies, and community oversight are generally safer than unknown sources.
• F-Droid: An alternative app store focused on free and open-source software. All apps are built from source by F-Droid's infrastructure, providing strong guarantees about what the code contains.

Red Flags to Watch For

• Sites that require you to complete surveys or click ads before downloading
• APK files that are significantly smaller or larger than expected for the app
• Downloads that come as ZIP files containing an APK (legitimate APKs are distributed directly)
• Sites that claim to offer paid apps for free (these are almost always pirated and potentially malware-laden)
• APKs with generic names like "update.apk" or "install.apk"

Security Risks of Sideloading

While sideloading itself is not inherently dangerous, it does bypass some of the protections that app stores provide:

Malware Distribution

The most obvious risk is installing malware disguised as a legitimate app. Malicious APKs can steal personal data, subscribe you to premium SMS services, encrypt your files for ransom, or use your device for cryptocurrency mining. Always verify the source and check the signing certificate.

Missing Updates

Sideloaded apps do not automatically update through the Play Store (unless the signing certificate matches the Play Store version). You are responsible for checking for and installing updates manually. Running outdated software means missing security patches.

No Play Store Protections

The Play Store performs automated security scanning, policy enforcement, and provides a mechanism for Google to remotely disable known-malicious apps. Sideloaded apps bypass all of these protections.

Compatibility Issues

APKs obtained from third-party sources may not be optimized for your specific device. Universal APKs are larger and may include unnecessary resources. Device-specific APKs from the Play Store are tailored to your hardware.

Handling Different File Formats

Modern app distribution uses several formats beyond plain APK files. Here is how to handle each when sideloading:

XAPK Files

XAPK files bundle an APK with OBB data or split APKs. You cannot install them directly. Use our XAPK to APK converter to extract the base APK, or use a dedicated XAPK installer app that handles the OBB file placement automatically.XAPK to APK converter

APKS and APKM Files

These contain split APKs from App Bundle distributions. You can install them using ADB's install-multiple command, use our APKS to APK merger, or use dedicated installer apps that handle split APK sessions.APKS to APK merger

AAB Files

If you somehow obtain an AAB file, you need to convert it to APK format first. Use our AAB to APK converter or Google's bundletool to generate an installable APK.AAB to APK converter

Sideloading on Different Android Versions

The sideloading experience varies across Android versions. Here are the key differences:

Android 14 and 15

The latest Android versions add additional protections. Apps targeting older API levels may trigger warnings about being built for an older version of Android. The system may also block installation of apps with very old target SDK versions entirely, as these apps cannot benefit from modern security features. Restricted Settings remain in effect for sideloaded apps requesting sensitive permissions.

Android 12 and 13

These versions refined the per-app installation permission model and introduced Restricted Settings. The installation confirmation screen was simplified, showing less information upfront but providing a "More details" option for users who want to review permissions.

Android 10 and 11

Scoped storage changes in these versions affect how file managers and installers access downloaded APK files. Some older installer apps may have trouble locating APKs in the Downloads folder due to storage access restrictions.

Android 8 and 9

These versions introduced the per-app "Install unknown apps" permission, replacing the global toggle. The installation flow is otherwise straightforward.

Advanced Sideloading with ADB

For power users and developers, ADB (Android Debug Bridge) provides the most flexible installation method:

Basic Installation

Connect your device via USB with USB debugging enabled, then run:

adb install path/to/app.apk

Replacing an Existing App

adb install -r path/to/app.apk

Installing Split APKs

adb install-multiple base.apk split_config.arm64_v8a.apk split_config.xxhdpi.apk

Downgrading an App

adb install -r -d path/to/older-version.apk

ADB installations bypass the "Install unknown apps" permission requirement and the graphical confirmation dialog, making them faster for repeated installations during development.

Best Practices for Safe Sideloading

To minimize risk while sideloading, follow these guidelines:

1. Only download from sources you trust. Official developer websites and established repositories are safest.
2. Always verify the signing certificate using our APK Verifier before installing apps that handle sensitive data.APK Verifier
3. Check file hashes when the source provides them. Any mismatch means the file was altered.
4. Keep Play Protect enabled. It provides a safety net even for sideloaded apps.
5. Revoke install permissions from apps after you finish installing. Do not leave browsers permanently authorized to install APKs.
6. Review permissions that the app requests. Be suspicious of apps requesting permissions unrelated to their function.
7. Keep sideloaded apps updated. Check the source periodically for security updates.
8. Use a separate user profile for testing untrusted apps. Android's multi-user feature isolates apps between profiles.
9. Back up your data before installing apps from unfamiliar sources. If something goes wrong, you can restore your device.
10. Monitor battery and data usage after installing a new sideloaded app. Unusual consumption may indicate malicious background activity.

When Sideloading Goes Wrong

If you suspect a sideloaded app is malicious:

1. Disconnect from the internet immediately (airplane mode) to prevent data exfiltration.
2. Uninstall the app through Settings → Apps. If it resists uninstallation, boot into Safe Mode (hold power button, long-press "Power off") and uninstall from there.
3. Change passwords for any accounts you accessed while the app was installed, using a different device.
4. Run a Play Protect scan to check for any remaining threats.
5. Factory reset if you cannot remove the malware or if it gained device administrator privileges. This is the nuclear option but guarantees a clean slate.

The Future of Sideloading

Sideloading on Android continues to evolve. Google is adding more protections without removing the capability entirely. Features like enhanced Play Protect scanning, Restricted Settings, and target SDK requirements make sideloading safer by default while still preserving user choice.

The European Union's Digital Markets Act may also influence sideloading policies, potentially requiring even more openness in app distribution. Regardless of regulatory changes, the fundamental ability to install apps from any source remains a defining feature of the Android platform.

Key Sideloading Changes to Watch on Modern Android

Sideloading is one of the things that still sets Android apart from more locked-down platforms. The process has quietly become safer over the years, between per-app install permissions, Play Protect scanning, and certificate-checking tools that anyone can use. What it asks of you in return is a little care: know where the file came from, check the signature, glance at the permissions, and keep an eye on what you have installed.

Stick to those habits and you get the best of both worlds: the freedom to install whatever you want, without handing your device and your data to whoever uploaded the file.

Fixing 'App Not Installed' Errors: The Complete Troubleshooting Guide

You downloaded a new game or tool, tapped install, waited a few seconds, and Android came back with the laconic "App not installed". No error code, no log, no hint. It is the most common generic install failure on the platform, and it can mean ten very different things depending on the actual underlying error.

What follows is every reasonably common cause, ordered roughly by how often we run into it, each with a one-line fix and a short explanation of why that fix works. At the end we show how to pull the real error out of logcat for the times the on-screen message isn't enough.

Common Cause #1: Low Storage Space

Even if an APK is only 50MB, Android needs about 3-4 times that space to decompress the files, verify the library data, and move it to the system partition. If you have less than 1GB free, your installation is at high risk of failing.

The Fix: Clear your "Downloads" folder or delete a large game you no longer play, then try again.

Common Cause #2: Signature Mismatch

As explained in our signing deep-dive, Android uses cryptographic signatures for security. If you have the official Facebook app installed and try to "update" it with a version from a random APK site, the signatures won't match, and Android will block the installation to protect your data.signing deep-dive

The Fix: Uninstall the existing app first (warning: this deletes your data). Then install the new APK.

Common Cause #3: Corrupted or Incomplete Downloads

If your internet connection drops for a split second, the APK might "finish" downloading but be missing a few bytes of code. Android's ZIP verification will detect this and abort.

The Fix: Delete the file and download it again using a stable Wi-Fi connection. Verify the file's SHA-256 hash using our APK Verifier.APK Verifier

Common Cause #4: Incompatible SDK Version

Developers set a minSdkVersion. If you're trying to install an app built for Android 14 on a phone running Android 10, it simply won't work.

The Fix: Check the app's requirements using our APK Info tool. If your Android version is too low, you'll need to find an older version of the app.APK Info toololder version of the app

Common Cause #5: CPU Architecture Problems (ABI)

Android uses different processors (ARMv7, ARM64, x86). If you download an "ARM64" app for an old "ARMv7" (32-bit) phone, it will throw the "App Not Installed" error.

The Fix: Use our APK Info tool to see which ABIs the APK supports. If your phone's CPU isn't listed, download a "Universal" build or the correct specific version. APK Info tool

Common Cause #6: "Install blocked by Play Protect"

Google Play Protect scans every APK for known malware signatures before it installs. Even apps from reputable sources occasionally trip it: root tools, region-specific banking apps, modified system utilities, or simply apps Play Protect has not seen before. The dialog usually says "This app is unsafe" and offers an "Install anyway" button, which can require a tap-and-hold or a trip into Settings.

The fix: If you trust the source, use the small "Install anyway" link in the block dialog. If the dialog is missing, open the Play Store, tap your profile icon → Play Protect → Settings, and toggle Scan apps with Play Protect off long enough to install, then turn it back on. Always re-enable Play Protect afterwards; one-shot disablement is the safer pattern.

Common Cause #7: Verified Boot / Disabled Sideloading

Some Android-on-laptop variants and some carrier-locked devices ship with sideloading disabled by default. The error often looks identical to "App not installed", but no permission dialog ever appears.

The fix: Open Settings → Apps → Special app access → Install unknown apps, find the app you used to download the APK (Chrome, your file manager, Telegram, etc.), and toggle "Allow from this source" on. The toggle is per-source, not global; if you switch to a different file manager, you have to enable that one too.

Common Cause #8: Per-User Profile or Work Profile Conflicts

If your device has a work profile or a secondary user, an app installed in one profile can block installation of a differently-signed copy in another. Symptoms: install works on the personal profile but fails silently in the work profile, or vice-versa.

The fix: Confirm which profile you are installing into. On most launchers, the work profile shows a small briefcase badge. Either uninstall the conflicting copy from the other profile or settle for using the existing copy.

Common Cause #9: 64-bit-only Device, 32-bit-only APK

Modern mid-range and flagship Android devices ship without the 32-bit ABI at all; the kernel is built without it. A 32-bit-only APK simply has no native libraries the device can load and will fail with a generic "Not installed" error. The reverse (a 64-bit-only APK on a 32-bit phone) is much rarer in 2026, since the last 32-bit-only Android phones shipped years ago.

The fix: Read the APK's manifest and lib/ directory in our APK Info tool, and you will see exactly which ABIs the package contains. If the device's ABI list (visible in Settings → About phone → Build details) does not overlap with the package's ABIs, find a different build.APK Info tool

Common Cause #10: Manifest installLocation mismatch

An app whose manifest sets android:installLocation="internalOnly" cannot be moved to an SD card. If your internal storage is short on space and the OS tries to install to external storage anyway (for instance, on some older Android One devices), the install silently fails.

The fix: Free up internal storage. The "move to SD" option is irrelevant for an internal-only app no matter how empty the SD card is.

Reading the Real Error from logcat

If none of the surface-level checks help, the underlying error is almost always visible in logcat. With ADB set up on a computer:

adb logcat -c                       # clear old logs
adb install path/to/example.apk     # try the install (or trigger from the device)
adb logcat -d | grep -i "PackageInstaller\|PackageManager"

The output usually includes a line such as:

INSTALL_FAILED_INSUFFICIENT_STORAGE
INSTALL_FAILED_UPDATE_INCOMPATIBLE: Package com.example signatures do not match newer version
INSTALL_FAILED_INVALID_APK: AndroidManifest.xml is malformed
INSTALL_FAILED_OLDER_SDK: Requires newer SDK version

Each of these maps directly to a fix:

• INSUFFICIENT_STORAGE: free space and retry.
• UPDATE_INCOMPATIBLE: signing-key mismatch with the existing install. Uninstall the existing app first.
• INVALID_APK: the file is corrupted; see our corrupt APK guide.corrupt APK guide
• OLDER_SDK: the app requires a newer Android version than this device runs.
• NO_MATCHING_ABIS: CPU architecture mismatch.
• VERIFICATION_FAILURE: Play Protect blocked it; see Common Cause #6.

If you do not have ADB available, an on-device alternative is the Settings → About phone → tap Build number 7 times → Developer options → Bug report flow, which captures the same logs into a zip file.

FAQ

Why does Android sometimes show no error message at all?

The system PackageInstaller activity has a strict timeout. If installation fails before the user-facing dialog finishes drawing, the dialog simply dismisses with no message. logcat still has the underlying reason.

Can a corrupted APK damage my phone?

No. The OS's package installer is sandboxed; a malformed APK can only fail to install. The actual risk from a bad APK is the code inside a successfully-installed app, not the install failure itself.

I'm getting "Parse error" specifically, not "App not installed". What's different?

"Parse error" is a stricter failure: the OS could not even read the file's structure. It is usually corruption (truncated download, ZIP-level damage). Re-download or run our corrupt APK recovery steps. "App not installed" usually means the file parsed fine but failed a later check.corrupt APK recovery

Can I install an APK over the same app installed from Play Store?

Only if the APK is signed with exactly the same upload key (and uses the same v2/v3 signing scheme). For most published apps that means: no, unless the publisher distributes the same APK both ways. Side-loading "the same app" from elsewhere will trigger INSTALL_FAILED_UPDATE_INCOMPATIBLE.

Quick Diagnostic Flow for Stubborn APK Install Failures

Clearing an "App not installed" error is mostly a process of elimination. Start with the cheap fixes, free up space and remove any old copy of the app, then work up to architecture and signature checks. The tools at XAPK to APK can take some of the guesswork out of the harder cases.

How to Update Android Apps Without Google Play Store

The Google Play Store is convenient for most people, but it isn't always the fastest or most reliable way to stay updated. Maybe you're on a Huawei phone without Google Mobile Services, maybe you're trying to dodge a bug in the current version, or maybe you just prefer to manage your app library by hand. In all of those cases, updating Android apps without the Play Store is easier than you think.

Below we go through the safer ways to apply updates by hand, so you can stay current without leaning on the Play Store.

Method 1: Manual Updating from the Developer's Own Source

This is the most direct method. For applications whose publisher hosts releases on their own website or a project release page (common for open-source software, browsers, messengers, and developer tools), you can fetch the latest signed build directly from that source.

Process:

1. Find the application on its publisher's official site or release page.
2. Compare the version number with the one currently on your phone.
3. Download the correct CPU architecture (ARMv7, ARMv8/ARM64).
4. Open the downloaded APK. Android will ask: "Do you want to install an update to this existing application?"
5. Click Install. Your data and settings will be preserved.

Method 2: Using Open-Source Update Channels

For users who specifically want to manage updates outside the Play Store (typically because the device does not ship with Google services, or because the user prefers open-source software), an open-source-focused store can scan installed apps and provide update notifications.

• F-Droid: The standard open-source repository for Android. Every app it distributes is built from publicly-auditable source code by F-Droid's own infrastructure, with cryptographic signatures verified at install time. It has an excellent built-in update notification system and is the recommended option for anyone who wants to update apps without the Play Store while still relying on a trustworthy source.
• Direct from developers: Some applications (browsers such as Firefox, messengers such as Signal) ship a self-update mechanism that pulls signed updates directly from the publisher's own servers, no third-party store involved.

Important: Understanding "App Downgrading"

While you can easily update forward, Android prevents you from installing an older version over a newer one. If you want to roll back an update, you will have to uninstall the app first, which results in data loss. We have a detailed guide on downgrading here.detailed guide on downgrading

How to Setup Your Device for Manual Updates

By default, Android blocks manual installations for security. You only need to change this setting once:

1. Go to Settings > Apps.
2. Select your browser (e.g., Chrome).
3. Scroll down and tap "Install Unknown Apps".
4. Toggle the switch to Allow.

Frequently Asked Questions (FAQ)

Keeping Manual App Updates Matched to Original Signatures

Updating outside the Google Play Store gives you more control over your Android experience. Whether you are tracking newer features or working around delivery delays in your region, manual updating is safe as long as you stick to legitimate sources, the developer's own release page or an open-source repository such as F-Droid, and check signatures before installing each update.check signatures

Verifying APK Signatures: How to Ensure Your App is Safe

Sideloading apps on Android offers freedom and flexibility, but it comes with a major risk: tampered applications. Malicious actors often modify popular apps to include spyware or adware before re-distributing them on unofficial sites. How can you be sure the APK you just downloaded is the exact same one the developer uploaded to Google Play?

The answer comes down to APK digital signatures. Below, we'll cover how app signing actually works and walk through using our Online APK Verifier to check an APK's hash and certificate before you decide to trust it.Online APK Verifier

What is an APK Signature?

A digital signature is a cryptographic proof of identity. When a developer finishes an app, they "sign" it using a private key (keystore). Android then uses the corresponding public key embedded in the APK to ensure:

1. Integrity: The file hasn't been changed since it was signed.
2. Authenticity: The developer is who they say they are.
3. Updates: Only APKs signed with the same key can update an existing app on your phone.

Evolution of Signing: V1, V2, V3, and V4

Google has continuously improved APK security over the years:

• V1 (Jar Signing): Signs individual entries in the ZIP. Slow and vulnerable to certain attacks.
• V2 (APK Signature Scheme): Signs the entire file block. Much faster to verify and more secure. (Android 7.0+)
• V3 (Key Rotation): Allows developers to change their signing key while maintaining app updates. (Android 9.0+)
• V4 (Streaming): Optimized for incremental installations over ADB. (Android 11+)

How to Verify APK Signatures Online

Our APK Verifier tool does not just calculate hashes; it performs a full cryptographic audit of the certificate chain. Here is how to use it:

Steps to Verify:

1. Navigate to the APK Verifier page.APK Verifier
2. Select your APK or XAPK file.
3. Our tool parses the META-INF/ directory and extracts the certificate data (.RSA, .DSA, or .EC).
4. Wait for the analysis to complete (it only takes seconds).
5. Review the Certificate Info: Developer name, organization, and country of origin.
6. Check the Hashes: Compare the SHA-256 displayed on our site with the value the publisher published on their own official site, project release page, or signing manifest.

Understanding Checksums (MD5, SHA-1, SHA-256)

Checksums are fixed-length strings representing the whole file. If you change a single pixel in an app's icon, the SHA-256 hash will completely change.

What a Signing Certificate Actually Tells You

When the verifier returns a certificate, the parts that matter for sideloading safety are not the colourful bits of the X.509 metadata but a small handful of fields. In practical terms:

• SHA-256 fingerprint of the certificate. This is the single most important value: a 64-hex-character hash that uniquely identifies the signing key. Two APKs with the same SHA-256 fingerprint were signed by the same private key. That is what "signature continuity" means in the OS's update logic.
• Subject Distinguished Name. Often something like CN=Some App, O=Example Inc., C=US. Useful as a hint, not as proof of identity, since an attacker can put any string they like in their own self-signed certificate's DN. Always cross-check the fingerprint, not the name.
• Validity period. Most legitimate publishing keys are generated with ~25-year validity (the historical recommendation is 10000 days). A certificate that expires next month, or one whose validity already overlaps the past, is a red flag.
• Signature algorithm. Modern apps use SHA256withRSA or SHA256withECDSA. MD5 is broken; SHA1withRSA is deprecated. An APK signed only with v1 / SHA-1 is suspicious in 2026.

Hash vs Signature: The Difference Most Tutorials Skip

People often conflate "hash" and "signature." They serve very different purposes and a safe verification needs both:

• A hash (SHA-256 of the entire APK) tells you whether the file's bytes are identical to a reference copy. If your hash matches the publisher's published hash, the file has not been altered since they computed that hash. A hash check alone says nothing about who created the bytes.
• A signature proves who created the bytes, specifically, that the holder of the private key paired with the signing certificate produced this file. A signature check alone says nothing about whether the file has been tampered with after signing (the OS will detect that and reject it, but the certificate itself does not "know" about the file content).

For a sideloaded APK, the strongest assurance combines the two: the certificate fingerprint matches the publisher's known fingerprint and the SHA-256 of the file matches the value the publisher published for that exact build.

Where to Get a Trustworthy Reference Fingerprint

The hardest part of verification is knowing the right value to compare against. A few reliable approaches, in rough order of confidence:

1. The publisher's own website or release page. Many open-source projects and security-conscious vendors publish the SHA-256 fingerprint of their signing certificate alongside their downloads. This is the gold standard.
2. An existing Play Store install. If the app is already installed on a Play-managed device, its certificate fingerprint is the publisher's fingerprint by definition. Compare your sideloaded APK's fingerprint against that. Tools like Apk Analyzer (in Android Studio) or apksigner verify --print-certs read it from an installed APK directly.
3. The first APK you ever installed of this app. If you have been using the app for a while and never had a "signature mismatch" prompt, you can use any of your older copies as the reference. Subsequent updates from the same publisher must use the same key (or rotate via v3, in which case the chain still verifies).
4. An archived public snapshot. The Internet Archive and similar services occasionally preserve old APK release pages along with their declared hashes. Useful for very old builds where the original publisher page is gone.

Common Verification Mistakes

• Comparing the wrong field. "MD5 of the APK file" is not the same as "MD5 of the certificate." Use the same field for the candidate file and the reference.
• Trusting the file's own metadata. An APK can include any version string, any package label, any author tag in its manifest. None of those are cryptographic. The signature block is the only thing the OS actually verifies.
• Skipping verification because the file was sent by a friend. A friend who says "this is the official APK" has not verified it any more than you have. Insist on a source that publishes a fingerprint you can check.
• Treating one matching field as sufficient. Match both the file's SHA-256 and the certificate's SHA-256 fingerprint; matching one but not the other is a sign that the bytes are altered or the source is impersonating the publisher.
• Disabling Play Protect for "convenience." Play Protect is a second-opinion scanner, not a substitute for signature verification, but it catches actual malware that signature verification cannot, because Protect knows about known-bad packages by content, not by signing key. Leave it on.

Frequently Asked Questions (FAQ)

Make Signature Verification Part of Every Sideload

Signatures are doing a lot of the heavy lifting in modern Android security. Spending the extra few seconds to run a file through an APK Verifier is a cheap way to keep a tampered app off your device before it ever gets installed.APK Verifier

How to View Android App Permissions Before Installing an APK

When you install an app from the Google Play Store, Android shows a simplified summary of what the app can access. Sideload an APK from a non-Play source and you have no such safety net, unless you read the manifest yourself. "Should a wallpaper app really need SMS and microphone access?" is exactly the kind of question this guide will help you answer.

What follows is the same workflow our team uses when triaging an unfamiliar APK: open it, read the uses-permission entries, decode the protection levels, and compare what the app says it needs against what its category usually requires. Our online APK Info tool does the binary-XML decoding for you so the whole process takes about ten seconds.online APK Info tool

Why Bother Auditing Permissions?

Malicious developers take popular free apps, alter them, and re-release them on third-party sites. While the app might look and function normally, its hidden code could be copying your contact list or recording your background audio. By viewing permissions pre-installation, you can spot these red flags of "permission creep."

How to Audit Any APK File (Online)

Our APK Info tool reads the manifest of your file entirely in your browser; the file is never uploaded to a server, and no code is executed. Here's how to use it:APK Info tool

Process:

1. Go to the APK Info page.APK Info page
2. Select your .apk file.
3. Wait for the analysis to finish (usually 5 seconds).
4. Scroll down to the Permissions Section.
5. Look for high-risk flags like: READ_SMS, PROCESS_OUTGOING_CALLS, or ACCESS_FINE_LOCATION.

Understanding Android Permission Levels

Not all permissions are created equal. Android categorizes them into three levels:

• Normal: Low-risk permissions that don't directly threaten privacy (e.g., SET_ALARM). Android grants these automatically.
• Dangerous: High-risk permissions (Contacts, Location, Camera). These must be confirmed by you when the app runs.
• Signature/System: Extremely high-risk. These are only available to apps signed by the device manufacturer or the OS itself.

Manual Method (Using a ZIP Viewer)

If you have some technical skill, you can audit permissions yourself:

1. Rename app.apk to app.zip and open it.
2. Find AndroidManifest.xml. (Note: It's in binary format and will look like gibberish in a text editor).
3. Use a tool like AXMLPrinter to convert it to readable text.
4. Search for tags starting with <uses-permission>.

Recommendation: It's much faster to use our online tool which decodes this for you instantly.online tool

What's Actually Stored in AndroidManifest.xml

The manifest is the source of truth for every permission, component, and feature an app declares. Inside an APK, the file is in binary XML form, not the plain text you see in source code, so it cannot be read with a normal text editor. Our APK Info tool decodes the binary XML and surfaces the relevant tags. The most important ones are:

• <uses-permission android:name="..."/>: every permission the app might ever request. The full list is here, including ones the app may never actually use at runtime.
• <uses-permission-sdk-23 ... />: same, but only requested when the app runs on Android 6 or later. Older devices are silently allowed without prompting.
• <uses-feature android:name="..." android:required="true|false"/>: hardware features the app uses (camera, GPS, NFC). When marked required, Play Store hides the app from devices that lack the feature.
• <application android:debuggable="true">: a giant red flag in a release APK. A debuggable app exposes its memory and process state to anyone with ADB access. Reject.
• <activity android:exported="true"> on sensitive activities: lets other apps launch that screen. For a privacy app, this often signals sloppy coding.

Permission Protection Levels: The Cheat Sheet

Android assigns every permission a "protection level". Knowing which level a request belongs to tells you how seriously the OS will treat it.

What "Hidden" Permissions Actually Means

A common misconception is that some permissions are secret. They are not: every permission an app might use must be declared in AndroidManifest.xml, and the OS refuses to grant any permission not listed there. What people usually mean by "hidden" is one of two things:

• Normal-level permissions are silent. They get granted at install time without any user interaction. The Play Store summary doesn't even show some of them. They are "hidden" in the sense of "easy to overlook", not in the sense of "undisclosed".
• App-defined custom permissions. Apps can declare their own <permission> tags and require them on internal components. These exist for inter-app communication and are not a privacy concern by themselves, but they can be abused if a popular app declares a custom permission with the wrong protection level and another app then uses it as a backdoor.

Either way, the answer is the same: read the manifest, do not trust a Play Store description on its own.

Worked Example: Auditing a Real APK

Suppose you have example.apk in your Downloads folder. Here is the exact workflow:

1. Open the APK Info tool in your browser.APK Info tool
2. Drop the APK on the upload area. Processing happens locally; the file does not leave your device.
3. Read the Permissions section. Each entry shows the constant name (android.permission.READ_CONTACTS) and a plain-language description of what it allows.
4. Compare the list against the app's category. Roughly, expect:
   • Camera apps: CAMERA, RECORD_AUDIO (for video), STORAGE/MEDIA write
   • Messaging apps: INTERNET, READ_CONTACTS, SEND_SMS (only if SMS-based), RECORD_AUDIO (for voice notes), CAMERA (for sending photos)
   • Games: INTERNET, sometimes RECORD_AUDIO (for in-game voice chat), billing-related permissions; rarely anything else
   • Utility apps (calculator, flashlight, weather): INTERNET (for ads), ACCESS_NETWORK_STATE, possibly LOCATION (weather only). Anything beyond that is suspicious.
5. If anything in the list does not fit the category, do not install. There is no good reason a calculator needs SMS access.

The same logic applies whether the file is an APK, an XAPK (where we read the inner base APK), or an APKS bundle (where we read each split's manifest).

Doing It from the Command Line

If you prefer the terminal route, the Android SDK ships aapt2, which dumps a manifest from any APK in plain XML:

aapt2 dump badging example.apk | grep "uses-permission"

Or use apksigner to verify the signing certificate at the same time:

apksigner verify --print-certs example.apk

The browser tool does the same thing for users who would rather not install an SDK just to vet a single file.

Frequently Asked Questions (FAQ)

Inspecting Manifest Permissions Before You Tap Install

You cannot judge what you cannot see. Spending ten seconds to view an APK's permissions before you sideload it is the difference between knowing what an app can reach and simply hoping it behaves. Read the list first, and install second.view an APK's permissions

What is OBB? A Complete Guide to Android Expansion Files

If you're a serious mobile gamer, you've definitely come across the term "OBB" or "Expansion File." You might see it in the form of a main.1234.com.game.obb file or inside an XAPK bundle. But while we all know that big games like PUBG, Genshin Impact, or Call of Duty use them, few people understand exactly what they are or how to manage them manually.

Below we break down what Opaque Binary Blobs (OBB) actually are, why Google introduced them, and how our OBB Extractor tool can help you pull apart and manage your game data.OBB Extractor tool

Why Google Created OBB Files

Early in Android's history, the Google Play Store had a very strict file size limit (50MB, then 100MB, then 150MB). This was to ensure that the core binary logic of an app wasn't too massive to process. However, high-fidelity games have gigabytes of 3D models, textures, and orchestral soundtracks.

Instead of raising the APK limit, Google created the Expansion File system. This allows developers to bundle one or two "Blobs" (up to 2GB each) alongside their APK. These blobs are effectively a customized ZIP file that the app's code can read quickly without "mounting" them as a drive.

The Anatomy of an OBB File

An OBB file is essentially an encrypted or unencrypted archive. Inside, you'll typically find:

• Assets: High-res textures, 3D meshes, and shaders.
• Audio: Compressed background music and voice-over files.
• Configuration: Level maps and game logic definitions.

How to Manage OBB Files in 2026

Managing these files has become harder with Scoped Storage (Android 11+), which blocks file managers from seeing the /Android/obb folder. Here is how to handle it:

1. Use an XAPK Installer: Programs like ours convert the OBB and APK into a single bundle that handles the file placement for you automatically.
2. SHIZUKU/FV File Explorer: Use advanced file explorers that can bypass scoped storage restrictions if you need to manually manage or replace OBB data files.
3. Online Extraction: Use our OBB Extractor to see what's inside an OBB without ever needing to install the giant game on your device.OBB Extractor

OBB vs APK Expansion vs AAB Asset Packs

Android has actually shipped three different mechanisms for "ship more data than fits in an APK" over the years. Knowing which one you are dealing with helps you find the right install path:

• OBB (Opaque Binary Blob, the classic): introduced by Google in 2012, widely used by games through the 2010s. The publisher uploads two files (APK + OBB) to the Play Store as a single package; on install, Play places the OBB at /sdcard/Android/obb/<package>/. Largely deprecated for new apps but still very common for sideloaded XAPKs of older or large titles.
• APK Expansion Files API: a Google-blessed way for the app itself to download the expansion the first time it runs, instead of shipping it inside the APK. Filenames look like main.<version>.<package>.obb and patch.<version>.<package>.obb. Same on-disk path as OBB.
• Play Asset Delivery / Asset Packs (modern): the AAB-era successor. Asset packs are part of the App Bundle and are streamed to the device by Play services, independently of the base APK. They live in app-specific cache directories, not under /sdcard, and you cannot move them around manually.

If you have an XAPK with a literal .obb file inside, you are dealing with the first two categories: the file goes in /sdcard/Android/obb/<package>/ and the path must match exactly or the app cannot find it.

The OBB Filename Format Decoded

OBB filenames look intimidating but they encode three pieces of information separated by dots:

main.42.com.example.game.obb
↑     ↑       ↑
│     │       └— package name (must match the APK's android:package)
│     └— version code (an integer; main and patch can have different versions)
└— main or patch ("main" = required initial data, "patch" = optional update layer)

If you copy the OBB into a directory whose name does not exactly match the package, the app will either silently fail to start or show a "Download failed because you may not have purchased this app" error, which is misleading. The error really means "the app expected to find its OBB and it isn't there."

Two Common Failure Modes

"Download failed because you may not have purchased this app"

Despite the wording, this almost never indicates an actual licensing problem with a sideloaded APK. Triggers, in order of likelihood:

1. OBB is missing entirely.
2. OBB is present but in the wrong directory (typo in the package-name folder).
3. OBB version-code doesn't match what the APK expects (you upgraded the APK but kept an old OBB, or vice-versa).
4. The app uses the licensing-check API and is genuinely refusing to run a non-Play install. This is rare; only some big-publisher games still do it.

App launches but immediately re-downloads

Means the OBB is present but inaccessible, usually a permission issue. On Android 11+ apps need explicit "All files access" or you need to push the OBB via ADB (adb push main.42.com.example.game.obb /sdcard/Android/obb/com.example.game/), which works regardless of in-app permission state. Confirm the file is owned by the right user and readable.

Are OBB Files Safe?

The OBB itself is just data, usually a custom container with the game's textures, audio, level definitions, scripts, and similar assets. It cannot execute code on its own; it is loaded and interpreted by the APK. That makes the safety of an OBB equivalent to the safety of the APK that opens it: as long as the APK's signing certificate matches what the publisher uses, and the APK passes verification, the bundled OBB is part of the same trusted package.

What you should not do is mix an OBB from one source with an APK from another. The OBB format is custom; data from version 41 will not necessarily load in version 42, and a deliberately crafted OBB designed to exploit a known parsing bug in the APK could in principle compromise the app. Treat APK + OBB as a paired set and obtain both from the same legitimate source.

Frequently Asked Questions (FAQ)

Managing Large Game Assets Across OBB and Play Asset Delivery

OBB files still carry the bulk of the data for a lot of big Android games. Google is gradually shifting studios toward "Dynamic Delivery" with AAB bundles, but the Opaque Binary Blob is far from gone, so it is worth knowing how it works if you sideload or back up games. Our XAPK Converter and OBB tools can handle the extraction when you need it.XAPK ConverterOBB tools

What is XAPK and How It Differs from APK

Most people meet their first XAPK file by accident. You go to grab an app or a game from somewhere other than the Play Store, tap download, and end up with a .xapk that your phone doesn't quite know how to open. So let's clear it up: what the format actually is, why someone invented it, and where it parts ways with the plain APK you already know.

Understanding APK Files

It helps to start with the APK itself, because the XAPK is built right on top of it. APK is short for Android Package, the one file Android uses to ship and install an app. Crack one open (more on that below) and you'll find everything it needs to run:

• Compiled code (DEX files)
• Resources (images, layouts, strings)
• Assets (raw files)
• AndroidManifest.xml (app metadata)
• Native libraries (if any)

What is an XAPK File?

An XAPK is really just a bundle: a base APK packed together with the extra pieces it can't carry on its own, usually OBB expansion data or a set of split APKs. It exists to solve one awkward problem, which is shipping an app that is simply too big to fit inside a single APK.

Why Do XAPK Files Exist?

The Play Store caps a base APK at 150MB. That is plenty for most apps, but a modern 3D game can burn through it on textures alone, long before you count the audio and video. The XAPK sidesteps that ceiling by keeping the APK and its heavy assets together in one download. Here is how the two formats compare:

How to Install XAPK Files

Android won't install an XAPK the way it would a normal APK, so you have two practical routes:

1. Use our XAPK to APK converter - Extract the APK and install it separately
2. Use an XAPK installer app - Specialised installers such as SAI (Split APKs Installer, an open-source tool) can install XAPK files directly

XAPK vs APK vs AAB: Quick Comparison

Here's a quick overview of all three formats:

• APK - Standard installable format, limited size
• XAPK - APK + OBB bundle, used by third-party stores
• AAB - Publishing format for Play Store, not installable

For a detailed comparison, check out our complete comparison guide.complete comparison guide

Converting Between XAPK, APK, and ZIP Formats

Many users search for ways to convert between different Android file formats. Here's what you need to know:

• APK to ZIP: You can rename any .apk file to .zip to explore its contents (AndroidManifest.xml, classes.dex, resources). This is the basis of how APK analysis tools work.
• ZIP to APK: While you can rename a .zip back to .apk, the file must have a valid Android package structure and be properly signed to install successfully.
• APKM to APK: The APKM format (used by APKMirror) is a bundle of split APKs. You can convert APKM to APK by extracting the base APK from the archive, or use our APKS to APK merger to merge all splits into one installable file.APKS to APK merger

Where Should You Get XAPK Files?

The safest place to install Android apps remains the official Google Play Store. The Play Store automatically handles split APKs and download-on-demand assets, so for most users there is no need to deal with XAPK files at all. Sideloading XAPK should be reserved for legitimate cases such as testing your own builds, installing an open-source app from its official project page, or restoring a backup of an app you legally own. Whatever the source, always pass the file through our APK Verifier first to confirm the signing certificate before installing.APK Verifier

How to Convert XAPK to APK Online

If all you really want is the installable APK, the quickest path is an online XAPK to APK converter. The free tool at xapktoapk.com runs entirely in your browser, with nothing to install. You pick the XAPK, the tool reads it right there on your device, pulls out the base APK, and hands it back for download. Because every step happens locally, the file never travels to a server, which is exactly what you want for something you built or backed up yourself.xapktoapk.com

XAPK Security Considerations

Anything you sideload deserves a little healthy suspicion, especially when it arrived from outside the Play Store. A few habits keep you out of trouble:

• Use the official source first. Prefer the Google Play Store or the developer's own website. Reserve sideloading for apps you legally own or open-source software obtained from a project's official release page.
• Verify APK signatures. Use our APK Verifier tool to check the cryptographic signature of extracted APK files before installing.APK Verifier tool
• Check permissions. Review the app permissions in the AndroidManifest.xml using our APK Info tool before installing.APK Info tool
• Scan for malware. Always run an antivirus scan on downloaded XAPK files, especially from unfamiliar sources.
• Compare file hashes. If you have one, compare the SHA-256 hash of your download with the publisher's official hash.

Where the XAPK Format Is Encountered

The XAPK container format originated outside the official Play Store distribution flow as a way to bundle a base APK with its expansion data or split APK configuration into a single downloadable file. You will encounter it when:

• Working with your own build artifacts that contain split APKs and OBB resources.
• Installing an open-source Android app whose project hosts its own signed releases.
• Restoring a backup you previously exported from a device you own.
• Receiving a beta build provided directly by an application's developer.

For all other cases, install apps directly from the official Google Play Store, where Play handles split APKs and OBB assets automatically with no user intervention required.

Frequently Asked Questions about XAPK

Final Thoughts on Working With XAPK Archives

The XAPK is a sensible answer to a real packaging problem: it keeps a big app and all of its parts in one file instead of scattering them across separate downloads. Yes, it costs you one extra step at install time, but in exchange nothing goes missing. Pull the APK out with the converter, check its signature, and you are good to go.

XAPK to APK Converter Android: Convert on Your Phone Without PC

You went looking for a game or app on a third-party site, tapped download, and ended up with an .xapk file instead of the plain .apk you expected. Then comes the annoying part, Android won't install it directly. To get around that you need an XAPK to APK converter for Android that can pull the installable APK out of the XAPK package right on your phone, with no computer involved.

Below are the methods I'd actually recommend for converting XAPK on a phone in 2026, starting with our free online tool and moving on to dedicated apps. They work on Samsung, Xiaomi, OnePlus, Pixel, and just about any device running Android 10 through Android 16.

What is XAPK and Why Can't Android Install It Directly?

An XAPK file is a bundle that contains one or more APK files plus OBB (expansion) data, all packaged into a single .xapk archive. While Google Play handles this multi-file delivery automatically through App Bundles, third-party sources package everything into XAPK for convenience.

Android's built-in package installer only recognizes .apk files. That's why you need an XAPK to APK converter Android app or tool to extract the base APK from the XAPK container before installation.

Method 1: Online Converter (Recommended)

The fastest way to convert XAPK to APK on Android is using our free browser-based tool. No app installation required, it works entirely in your mobile browser:

1. Open xapktoapk.com in Chrome or Firefox on your Android phone.xapktoapk.com
2. Tap the upload area and select your .xapk file from your Downloads folder.
3. Wait a few seconds for the conversion to complete (everything processes on your device).
4. Tap Download APK to save the extracted APK.
5. Open the downloaded APK to install it (enable "Install from Unknown Sources" if prompted).

This method works on all Android phones including Samsung Galaxy, Xiaomi, OnePlus, Google Pixel, Oppo, Vivo, Huawei, and more. No root required.

Method 2: Using ZArchiver (File Manager)

ZArchiver is a popular free file manager for Android that can open XAPK files since they're essentially ZIP archives:

1. Install ZArchiver from Google Play Store.
2. Navigate to the folder containing your .xapk file.
3. Long-press the .xapk file and select "View".
4. Inside, you'll see files like base.apk, config.*.apk, and *.obb.
5. Extract base.apk, this is your installable APK.
6. For games with OBB, copy the OBB file to /Android/obb/[package-name]/.

Method 3: SAI (Split APKs Installer)

Instead of converting, you can install XAPK files directly using SAI (Split APKs Installer):

1. Install SAI (Split APKs Installer) from its official source, the project's GitHub releases page or F-Droid.
2. Open SAI and tap "Install APKs".
3. Change file type filter to show XAPK files.
4. Select your .xapk file, SAI will install all split APKs and copy OBB files automatically.

SAI is particularly useful when XAPK contains multiple split APKs (like different DPI configurations or ABI splits for arm64, arm, x86).

Method 4: Use ADB from a Computer

For users with a USB cable and a computer, Android Debug Bridge (ADB) is the most direct way to install split-APK or XAPK packages without any installer app. Enable USB debugging in Developer options on the phone, extract the XAPK to a folder, and run adb install-multiple base.apk split_config.*.apk from a terminal. OBB data can be copied to the device with adb push main.<version>.<package>.obb /sdcard/Android/obb/<package>/.

Compatibility Notes for Android Versions

Our XAPK to APK converter for Android works on all modern Android versions:

• Android 10-12: Standard XAPK conversion and installation works smoothly.
• Android 13-14: Minor permission changes, you may need to grant "Install from Unknown Sources" per-app in Settings.
• Android 15-16: Scoped Storage restrictions apply. Use our online tool or SAI for the smoothest experience. When using ZArchiver, extract files to your Downloads folder.

Tips for Safe XAPK Conversion on Android

• Verify the source: Use XAPK files only from legitimate origins, your own builds, open-source projects' official release pages, or beta builds provided directly by the application's developer. Avoid sites that re-host paid or copyrighted apps.
• Check the APK: After conversion, use our APK Verifier to ensure the signature is authentic.APK Verifier
• Review permissions: Use our APK Info tool to inspect what permissions the app requests before installing.APK Info
• Scan with VirusTotal: Upload converted APK files to VirusTotal for a multi-engine malware scan.VirusTotal

Frequently Asked Questions

Converting XAPK Packages Directly on Your Phone

Converting XAPK to APK on Android is easy enough once you've picked the method that fits you. The free online converter is the fastest route, ZArchiver is there if you'd rather extract things by hand, and SAI installs XAPK packages directly, so any XAPK file on your phone is manageable without ever reaching for a PC. Just keep to files from sources you trust, your own builds, official open-source release pages, or apps you legally own, and check the APK signature before you install.free online converter

APK vs XAPK vs AAB: Complete Comparison

Android has been through a lot of versions, and the way apps get packaged and handed out has shifted just as much. Most of the time you only care about one thing, getting an app installed. But the moment a file refuses to open the way you expect, it helps to know what you're actually holding. APK, XAPK, and AAB are the three names you keep bumping into, so here is what each one really is and when it matters.

Quick Comparison Table

APK (Android Package)

XAPK (Extended APK)

AAB (Android App Bundle)

When to Use Each Format

Real-World File Sizes: What These Numbers Look Like in Practice

These differences stop feeling abstract the moment you check the size of an app you have actually downloaded. The figures below are roughly what people run into in 2026, though the exact number shifts with your device, your language, and the CPU your phone uses.

The rule of thumb is simple enough. If the whole thing fits in roughly 100–150 MB and only targets one CPU architecture, a plain APK is the easiest thing to deal with. The moment a package has to carry several architectures (arm64-v8a, armeabi-v7a, x86_64), assets for many screen densities, or large chunks of gameplay data, that simplicity breaks down: XAPK keeps everything in one download you can move around yourself, while AAB hands the job to Play, which trims the bundle down to whatever each device actually needs.

Inside Each Container: A Quick Tour

What's actually inside an APK

Open any .apk with an archive tool and you will see roughly the same layout: an AndroidManifest.xml describing the app's identity and permissions, a classes.dex file (or several) holding the compiled bytecode, a resources.arsc resource table, a res/ directory of pre-compiled images and layouts, and an assets/ directory for any raw files the developer chose to ship as-is. Native code lives under lib/<abi>/, where abi is the CPU architecture. A META-INF/ directory contains the cryptographic signature that proves who built the file.

What changes inside an XAPK

An XAPK is itself a ZIP archive containing one or more APK files plus a sidecar manifest.json. The simplest XAPK is "base APK + one OBB file"; more complex bundles look like "base APK + several config.<abi>.apk, config.<density>.apk, and config.<language>.apk splits", that is, the same structure that AAB produces on the server, packaged for offline distribution.

What changes inside an AAB

An AAB is also a ZIP, but it is intentionally not directly installable. Inside you find a BundleConfig.pb protobuf describing how the bundle should be split, plus base/ and (optionally) feature_module/ directories holding manifests, resources, dex files, and native libs in their pre-split form. Google's own server-side tool, plus the open-source bundletool, turn this bundle into the per-device APK splits the user actually installs.

Decision Guide: Which Format Should You Reach For?

If you are reading this because you have a file in your hands and are not sure what to do with it, answer these questions in order:

1. Is the file a single .apk under ~150 MB? Install it directly. Verify the signing certificate first with our APK Verifier if it came from outside the Play Store.APK Verifier
2. Is it a .xapk file? Either install it with an open-source split-APK installer such as SAI, or convert it to a single APK using our browser-based converter and install that.browser-based converter
3. Is it a .apks archive? That is the output of bundletool already split into per-device APKs; merge the relevant splits with our APKS to APK merger or use ADB's install-multiple command.APKS to APK merger
4. Is it an .aab file? You cannot install it directly. Use AAB to APK to run bundletool for you and produce a universal APK first.AAB to APK