APKLeaks is an open-source command-line scanner that pulls URIs, endpoints, and hardcoded secrets out of Android APK files.
It targets mobile security testing and bug bounty reconnaissance. The tool decompiles an app, then matches the code against a set of regex patterns.
GitHub: dwisiswant0/apkleaks | Stars: 6.2k | Latest release: v2.6.3 (October 2024) | License: Apache-2.0
It is written in Python by dwisiswant0 and has been available since 2020. The project sits in the bug bounty and pentest tooling space alongside decompilers like Apktool .
What is APKLeaks?
APKLeaks answers one question: what sensitive strings are baked into this APK?
It runs jadx to decompile the APK into readable Java source, then scans every file against its pattern set. Matches are grouped by pattern name and written out.
The default patterns cover common credential formats: AWS access keys, Google API keys, JWTs, Firebase URLs, and similar. The bundled regexes.json ships with 50+ of these rules.
Because detection is regex-based, APKLeaks finds strings that look like secrets. It does not confirm that a matched key is live, so results still need manual triage.
Key Features
| Feature | Details |
|---|---|
| Input | A single Android APK file (-f file.apk) |
| Decompiler | jadx (auto-downloaded on first run if missing) |
| Detection | 50+ built-in regex patterns for secrets, keys, URIs, and endpoints |
| Custom rules | JSON pattern file via -p, mapping names to regular expressions |
| Output | Terminal, plus text or JSON file (-o, --json) |
| Disassembler args | Passed through with --args (e.g. --deobf) |
| Install | pip (pip3 install apkleaks), source, or Docker |
| License | Apache-2.0, open-source |
How detection works
APKLeaks does static analysis only. It never runs the app; the workflow is decompile, then grep with structure.
After jadx produces source, the scanner walks the output and applies each regex. A hit records the pattern name and the matching string, so an AWS key surfaces under its own heading rather than in a flat dump.
Custom patterns
The built-in rules cover well-known third-party credentials, but internal formats vary per organization.
You can supply your own rules in a JSON file with -p custom-rules.json. Each entry is a name-to-regex pair, for example "Amazon AWS Access Key ID": "AKIA[0-9A-Z]{16}".
This is the main tuning lever. Adding a pattern for an internal token prefix or a private API host makes the scan relevant to a specific codebase.
Output formats
By default APKLeaks prints findings to the terminal and writes a text file. Passing --json switches the file output to JSON.
JSON is the format to use when feeding results into another script or a triage pipeline. If -o is omitted, the tool picks an output filename automatically.
Getting started with APKLeaks
The fastest path is pip. Docker is the cleaner option if you would rather not install jadx and its Java runtime on the host.
pip3 install apkleaks
apkleaks -f ~/path/to/app.apk
For JSON output aimed at further processing:
apkleaks -f app.apk -o results.json --json
The project README
documents the Docker image and the full flag set. The one decision worth making up front is whether to rely on the default patterns or point -p at a curated rule file for the target.
When to use APKLeaks
APKLeaks fits reconnaissance. When I want a fast read on which keys and endpoints an APK leaks, a single-purpose scanner beats spinning up a full framework.
It suits bug bounty hunters triaging many APKs, and pentesters doing a first pass before deeper manual review. The custom pattern support makes it useful for internal app audits where the interesting secrets are company-specific.
For a broader assessment (manifest analysis, dynamic testing, a dashboard), MobSF covers more ground and handles both Android and iOS. The two work together well: APKLeaks is a focused extractor, MobSF a full workbench.
Limitations
Detection is regex-based, so false positives are expected. A string that matches an AWS key pattern is not necessarily a valid key, and triage is manual.
Coverage is Android-only and static-only. There is no dynamic analysis, no iOS support, and no first-class CI integration. It is a CLI you script yourself.
Release cadence has slowed: v2.6.3 shipped in October 2024, with commits since then but no newer tagged release. For an actively maintained, broader mobile suite, compare against MobSF and the other tools in the mobile category.