What it checks
- Permissions in plain English, sorted by risk. Reading SMS, call logs, location or other apps’ screens comes first.
- Special powers that spy apps depend on: accessibility services, device admin, notification access, a VPN, starting at boot, and hiding the app icon.
- The signing certificate, with its SHA-1 and SHA-256 fingerprints. An app claiming to be from a big company but signed by an unknown name is a red flag.
- Known stalkerware, by package name and certificate, against the Echap list that also powers our package lookup.
- Analytics and ad SDKs and the web addresses written into the code.
- App bundles (XAPK, APKS, APKM): the base APK and every split, and whether all of them share one signing key. A mismatch means someone altered the bundle.
- Extensions: the extension ID, which sites it can read, where it updates from, and risky code such as eval, remote scripts and keystroke listeners.
How to get an APK off a phone
Use a computer with Android’s adb tool and USB debugging turned on. Find the package name with adb shell pm list packages. Then run adb shell pm path with that name, and adb pull on the path it prints. A split app prints several paths. Pull them all and zip them together, or check base.apk on its own. Turn USB debugging off again when you finish.
How to get an extension file
For an extension already installed in Chrome, open chrome://extensions, turn on Developer mode, and note its ID. The files sit in your Chrome profile under Extensions, in a folder with that ID. Zip that version folder and drop the zip here. Firefox stores installed add-ons as XPI files in the profile’s extensions folder.
What it does not do
It does not run the app, decompile it or catch every threat. Permissions show what code can do, not what it does. Many honest apps need powerful permissions. Use the result to decide what to look at next: the links send the hash to VirusTotal, MalwareBazaar and sandboxes. Use it only on apps and extensions you own or that were installed on your own device. It is not a tool for cracking or redistributing software.
Frequently asked questions
Is my file uploaded anywhere?
No. The file is read and unpacked in your browser tab. Nothing is sent unless you press the reputation button, and that sends only the file's hash, never the file.
Can this tell me an app is safe?
No. It shows what an app or extension can do, who signed it and which code it carries. A clean result means no warning signs were found here. A full antivirus scan or a sandbox goes much further.
How does it spot stalkerware?
It compares the package name and signing certificate with a public list of known stalkerware, maintained by the Echap project. It also flags the powers spy apps rely on, such as accessibility access, SMS and call logs, and hiding the launcher icon.
Which files does it accept?
Android APK files, app bundles (XAPK, APKS and APKM), Chrome CRX files, Firefox XPI files and zipped extension folders. For a bundle it reads the base APK and every split, and checks they share one signing key.
How do I get the APK of an app on my phone?
The safest route is a computer with adb. Run adb shell pm path followed by the package name, then adb pull on the path it prints. File-manager apps that export APKs also work, but install only well-known ones.
Can I use this to crack or modify apps?
No. It reads the manifest, signatures and strings to answer one question: is this app or extension safe to keep? It does not decompile, patch or repackage anything.