apkleaks

Scan APK for hardcoded secrets

$ apkleaks -f [app.apk]

$ apkleaks -f [app.apk] -o [results.json]

$ apkleaks -f [app.apk] -p [patterns.json]

$ apkleaks -f [app.apk] -v

apkleaks -f apkfile [-o output] [-p patterns] [options_]

apkleaks scans Android APK files for hardcoded secrets, API keys, and sensitive information. It decompiles the APK, searches through code and resources using regex patterns, and reports potential security issues.
The tool helps identify accidental exposure of credentials, private keys, URLs with tokens, and other sensitive data that developers may have inadvertently included in their applications.

-f file

APK file to analyze

Output file for results

Custom patterns file (JSON)

Additional jadx arguments

Verbose output

Disassemble with jadx (default)

- API keys (AWS, Google, Facebook, etc.)
- Private keys and certificates
- Tokens and secrets in URLs
- Hardcoded passwords
- Database credentials
- Custom regex patterns

May produce false positives requiring manual verification. Only detects string-based secrets; encrypted or obfuscated data won't be found. Decompilation may fail for heavily protected APKs.

apkleaks was created for Android security assessments, automating the process of identifying leaked secrets that manual code review might miss.

apktool(1), jadx(1), androguard(1)