Skip to tool
Mobile

Mobile Build Artifact Inspector

Inspect IPA, APK, and AAB metadata without uploading a release build.

Online tools Pricing

Open or drop MyApp.ipa, MyApp.apk, or MyApp.aab

The archive is transferred directly to a Web Worker. It is not copied into page state or uploaded.

Artifact report
The identity, file inventory, architecture, signing, and metadata evidence will appear here.
Ready

Prefer a native workflow?

Keep Mobile Build Artifact Inspector one shortcut away.

DevSexy for Mac puts the same private workflow in a focused desktop app, with global shortcuts and no browser tab to manage.

Global shortcutOffline-readyLocal processing
Try the Mac app free

This browser tool remains free.

Read what the artifact declares

APK, AAB & IPA Analyzer Online — Inspect Build Artifacts Locally

APK, AAB, and IPA files are archives with different metadata chains. Static inspection can inventory those declarations; it cannot prove what the installed app will do.

Artifact identity ledger

Format

APK / AAB / IPA

Package or bundle ID

Declared application identity

Version

Marketing and build values

Archive size

Compressed bytes

Minimum and target OS

Declared compatibility

Architectures

Bundled native slices

APK evidence path

archive → AndroidManifest.xml → components + permissions → DEX/resources/native libraries

  • Activities, services, receivers, and providers
  • Exported component surface
  • Declared and dangerous permissions
  • SDK levels and features
  • Native libraries grouped by ABI
arm64-v8a
x86_64
res
DEX + assets

AAB evidence path

base module + feature modules + asset packs → device configuration → delivered APK set

  • Module inventory and delivery type
  • Configuration splits by ABI, density, and language
  • Bundle manifest and SDK declarations
  • Uncompressed contribution by module
Play delivery
Device configuration
Dynamic feature

IPA evidence path

.ipa → Payload/*.app → Info.plist → entitlements → embedded provisioning profile

  • Bundle ID, version, and URL schemes
  • ATS and background-mode declarations
  • Entitlements and keychain groups
  • Frameworks and Mach-O architectures
  • Provisioning team, profile, and expiry
.ipaPayloadInfo.plistEntitlementsProfile

Signing evidence is not a trust verdict

Certificate subject, issuer, fingerprint, validity, and embedded scheme describe what is present. They do not prove store notarization, current revocation status, ownership, or runtime integrity.

Subject / issuer
SHA-256 fingerprint
Valid from / to
Present ≠ trusted

Static inspection limits

Not executed

No code, service, or lifecycle behavior runs.

No malware verdict

Structure alone cannot declare an app safe.

No runtime permission state

User grants and OS dialogs are not observed.

No network proof

Endpoints and traffic are not contacted.

No privacy assessment

Data handling and policy compliance require broader evidence.

Mobile artifact questions

Is an AAB the APK installed on a device?
No. An app bundle contains modules and configuration resources that a delivery system uses to build device-specific APKs.
Does a declared permission prove the app uses it?
No. It exposes requested capability and review surface; runtime code paths, user grants, and OS behavior require separate evidence.
Does inspection upload my release build?
No. Archive reading and report generation occur locally in the browser worker.

Run a reproducible example

Inspect a tiny synthetic IPA-shaped ZIP containing one public XML Info.plist. It is unsigned, has no executable, and is not installable.

Using an example replaces the current input, reference input, operation, and options. Public demonstration data only.

Inspect a synthetic archive

The built-in fixture contains only Payload/Demo.app/Info.plist with a demonstration bundle ID.

Input

Payload/Demo.app/Info.plist
CFBundleIdentifier = com.example.demo
CFBundleName = Public Demo

The report finds one file and the bundle ID. It does not establish signing, store eligibility, or runtime behavior.

Bundle ID: com.example.demo
Entries: 1
not executed

Continue with a related task

Apple Property List Studio

Read XML and binary property lists, inspect types, and export structured data.

X.509 Certificate & PEM Inspector

Decode certificates, SANs, key usage, and validity without sending private material away.

App Link Association Studio

Build and simulate Apple AASA and Android assetlinks routing rules.

Repeat the task in DevSexy for Mac

Use the native app for repeated offline work and direct Option shortcuts.

Direct answer

What is Mobile Build Artifact Inspector?

Inspect APK, AAB, and IPA files online in your browser, including manifests, modules, plists, architectures, size, and signing evidence, without uploading the build.

What can it do?

  • Inspect

How to use Mobile Build Artifact Inspector

  1. 01

    Prepare the input

    Use the synthetic example or open an authorized local IPA, APK, or AAB.

  2. 02

    Choose the operation

    Choose the summary or file inventory and whether to read supported identity metadata.

  3. 03

    Review the evidence

    Treat paths and sizes as structural evidence; use platform tools for signatures, compiled manifests, and installability.