rea-reverse

AndroidManifest.xml and resources.arsc decoder

Drop a binary AndroidManifest.xml, any compiled res/*.xml or a resources.arsc to read it as XML. Drop a whole APK or AAB and the manifest is pulled out of it, with @0x7f… resource ids replaced by their names from the resource table.

Your APKs never leave your browser. Files are read locally in a Web Worker that has no network access. An APK is read through its ZIP directory: only the manifest, resources.arsc and the XML file you pick are inflated. How to verify this yourself

Open the tool on its own page (no ads, no analytics)

Unzip an APK and open AndroidManifest.xml, and you get binary: Android compiles every XML resource into its own binary XML format (AXML) with a string pool and attribute resource ids. aapt2 dump xmltree and apktool d turn it back into text, but both need the Android SDK or Java, and apktool decodes the whole app when you only wanted the manifest.

This decoder runs in your browser. Drop the manifest you extracted, any other compiled XML, the resources.arsc resource table, or the whole APK or AAB.

How to use

  1. Take the APK or AAB itself, or unzip it (unzip app.apk AndroidManifest.xml resources.arsc) and take the binary file you want. Layouts and other compiled XML live under res/.
  2. Drop it onto the drop zone above, or press Choose a file.
  3. Read the Summary (package, version, SDK levels, label), then the decoded XML. For an APK, pick any other XML file under Other XML files and press Decode, or open the resources.arsc dump.

Real example output

We dropped the F-Droid build of Ves Android Image Compare (version 51, SHA-256 ba280b33…6ef6) into this page and copied what it displayed. Layout condensed (label and value on one line, buttons left out, the manifest and the expanded resources.arsc dump cut where marked); every value is verbatim. The Decoded in time varies per run.

Sample: com.vincentengelsoftware.vesandroidimagecompare_51.apk, an open-source app from F-Droid (downloaded 2026-10-13) (f-droid.org/packages/com.vincentengelsoftware.vesandroidimagecompare/)

Summary
Input                   APK
Size                    1.8 MB
Root element            <manifest>
Elements                57
Package                 com.vincentengelsoftware.vesandroidimagecompare
Version name (code)     2.3.6 (51)
SDK                     min 28 · target 36
App label               vesIC
Permissions requested   3
Components              activity × 15 · provider × 2 · receiver × 1
Resource table          2840 resources in 15 types
Names for resource ids  Yes: @0x7f… references are written as @type/name
Decoded in              31 ms

Decoded AndroidManifest.xml
<?xml version="1.0" encoding="utf-8"?>
<manifest android:versionCode="51" android:versionName="2.3.6" android:compileSdkVersion="36" android:compileSdkVersionCodename="16" package="com.vincentengelsoftware.vesandroidimagecompare" platformBuildVersionCode="36" platformBuildVersionName="16" xmlns:android="http://schemas.android.com/apk/res/android">
  <uses-sdk android:minSdkVersion="28" android:targetSdkVersion="36" />
  <uses-permission android:name="android.permission.CAMERA" />
  <uses-feature android:name="android.hardware.camera" android:required="false" />
  <uses-permission android:name="android.permission.REORDER_TASKS" />
  <permission android:name="com.vincentengelsoftware.vesandroidimagecompare.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION" android:protectionLevel="0x00000002" />
  …
  <application android:theme="@style/Theme.VesAndroidImageCompare" android:label="@string/app_name_short" android:icon="@mipmap/ic_launcher" android:fitsSystemWindows="false" android:allowBackup="true" android:largeHeap="true" android:supportsRtl="true" android:extractNativeLibs="false" android:roundIcon="@mipmap/ic_launcher" android:appComponentFactory="androidx.core.app.CoreComponentFactory" android:localeConfig="@xml/locales_config">
    …
    <activity android:name="com.vincentengelsoftware.androidimagecompare.ui.main.MainActivity" android:exported="true" android:launchMode="2">
      <intent-filter android:label="@string/app_name_short">
        <action android:name="android.intent.action.MAIN" />
        <category android:name="android.intent.category.LAUNCHER" />
      </intent-filter>
…

resources.arsc (2840 resources)
…
  <mipmap name="ic_launcher" id="0x7f0d0000" config="mdpi">res/d2.webp</mipmap>
…
  <mipmap name="ic_launcher" id="0x7f0d0000" config="anydpi">res/BW.xml</mipmap>
…
  <string name="app_name_short" id="0x7f0f001e">vesIC</string>
  <string name="ask_for_review_negative" id="0x7f0f0020">Don't show up again</string>
  <string name="ask_for_review_negative" id="0x7f0f0020" config="de">Nicht nochmal anzeigen</string>
…

What it reads

  • Binary XML (starts with 03 00 08 00): AndroidManifest.xml, res/layout/*.xml, drawables, res/xml/ configs such as the network security config. Text XML is recognised and refused, so you know the file was never compiled.
  • resources.arsc: the resource table of an APK.
  • APK: the manifest is pulled out of the archive and its @0x7f… references are named through the APK’s own resources.arsc (@string/app_name, @style/AppTheme). Every other compiled XML file in the APK is listed; pick one and press Decode.
  • AAB: the protobuf manifest in base/manifest/AndroidManifest.xml is decoded and named through base/resources.pb.
  • Archives are read through their ZIP directory (ZIP64 too): only the entries decoded are inflated, so a 500 MB APK costs little more than its manifest.

What you see

  • Summary: the input type, the root element and element count; for a manifest also the package, version name and code, min and target SDK, the app label resolved to its default string, the number of permissions and the components by type.
  • Decoded XML: namespaces declared on the root, attributes named from the android.R.attr resource ids (the names aapt2 dump xmltree prints), integers in decimal, flags in hex, booleans as true / false, references as @type/name where the table has them and as @0x… hex where it does not (framework resources).
  • resources.arsc: the resource count per type, and the whole table as XML, one line per resource and configuration: <string name="app_name" id="0x7f030000" config="fr">…</string>. File resources show the path inside the APK, references show @type/name.

Download and Copy save the XML. Very large outputs show their first 1 MiB on the page.

How we checked it

The parsers are the APK analyzer’s, tested against aapt2 dump xmltree, aapt2 dump resources and aapt2 dump badging on self-built fixtures (test/apk/fixture.apk, fixture.aab) and on open-source APKs from F-Droid. For this page we decoded the F-Droid build of Ves Android Image Compare (version 51) and compared every attribute of the manifest with aapt2 dump xmltree, and each named reference with the resource id aapt2 dump resources gives for it.

How your data stays private

  • The decoder runs in a separate frame served from tools.rea-reverse.com, and decoding runs in a Web Worker inside it, on your device. Nothing you drop is uploaded.
  • This page shows one ad, below the article. The ad script runs on rea-reverse.com; the frame is a different origin, so the browser does not let the ad script, or any other script on this page, read the file you drop or the results.
  • The frame’s Content Security Policy blocks every request its scripts could make (connect-src 'none', no third-party resources at all). The frame cannot open windows or navigate this page by itself. The only things it passes to this page are its height and the analytics events below.
  • Tags, attributes and values from the file are shown as plain text; URLs inside it are never requested.
  • Analytics events contain only coarse values: success or an error code, the input type, a resource-count bucket, a size bucket and a duration bucket. No package names, values or resource names. The frame hands them to this page, which sends them. The full list is on the privacy page.
  • Prefer no ads and no analytics at all? Open the decoder on its own page.

How to verify this yourself

  1. Open your browser’s developer tools on the Network tab and load this page. Requests to tools.rea-reverse.com are the frame: its HTML, styles, fonts and scripts, and the worker script /_astro/axml-worker-*.js. Requests to Google domains are the ad on this page.
  2. Clear the log, then drop an APK. Type domain:tools.rea-reverse.com in the filter box. At most the worker script /_astro/axml-worker-*.js appears again (a fresh worker is prepared for the next run); no request carries your data. Ad requests may continue, but they come from this page and carry nothing from the frame.
  3. Click the android-manifest-decoder/ document from tools.rea-reverse.com and open Headers: its Content-Security-Policy has connect-src 'none', and frame-ancestors https://rea-reverse.com. In Chrome, Application > Frames also shows the frame’s origin and policy. The worker runs under default-src 'none'; script-src 'self'; connect-src 'none'.
  4. Check the isolation: in the Console, with the context set to top, run document.getElementById('tool-frame').contentDocument. It returns null. frames[0].document throws a SecurityError. That is what the ad script gets too.
  5. Or load the page, go offline, and drop the file. It still works.
  6. Compare with aapt2 dump xmltree --file AndroidManifest.xml app.apk.

Limitations

  • It decodes; it does not re-encode, edit or rebuild an APK.
  • Styles, arrays and plurals in resources.arsc are listed by name with the value (complex); their items are not expanded.
  • Configurations are named by language, density and SDK level (fr, xxhdpi, anydpi-v26). Any other qualifier (region, night mode, screen size) shows as +….
  • Framework references (@0x0103…) stay hex, as in aapt2’s output. An AAB’s resources.pb names references but is not dumped.

Command-line equivalent

aapt2 from the Android SDK build-tools (2.20-13193326) prints the same manifest as a tree, with references left as hex ids (trimmed):

$ aapt2 dump xmltree --file AndroidManifest.xml com.vincentengelsoftware.vesandroidimagecompare_51.apk
N: android=http://schemas.android.com/apk/res/android (line=2)
  E: manifest (line=2)
    A: http://schemas.android.com/apk/res/android:versionCode(0x0101021b)=51
    A: http://schemas.android.com/apk/res/android:versionName(0x0101021c)="2.3.6" (Raw: "2.3.6")
…
      E: application (line=25)
        A: http://schemas.android.com/apk/res/android:theme(0x01010000)=@0x7f1002b9
        A: http://schemas.android.com/apk/res/android:label(0x01010001)=@0x7f0f001e
        A: http://schemas.android.com/apk/res/android:icon(0x01010002)=@0x7f0d0000
…
        A: http://schemas.android.com/apk/res/android:localeConfig(0x0101065b)=@0x7f120001
…

The hex ids resolve through the resource table (trimmed):

$ aapt2 dump resources com.vincentengelsoftware.vesandroidimagecompare_51.apk
…
    resource 0x7f0d0000 mipmap/ic_launcher
      (mdpi) (file) res/d2.webp
…
    resource 0x7f0f001e string/app_name_short
      () "vesIC"
…
    resource 0x7f1002b9 style/Theme.VesAndroidImageCompare
…
    resource 0x7f120001 xml/locales_config
      () (file) res/Br.xml type=XML
…

FAQ

How do I decode AndroidManifest.xml online without uploading the APK?

Drop the APK, or the AndroidManifest.xml you unzipped from it, on this page. Decoding runs in a Web Worker in your browser that has no network access, so the file is never sent anywhere.

Why is AndroidManifest.xml unreadable after I unzip the APK?

Because aapt2 compiled it into Android binary XML (AXML): tag and attribute names sit in a string pool, attributes are identified by resource ids and values are typed. Every XML file under res/ in an APK is compiled the same way; this page decodes all of them.

What is an AXML decoder?

A tool that turns Android binary XML back into text: it reads the string pool, maps attribute resource ids such as 0x01010003 to names such as android:name, and writes each typed value as text. aapt2 dump xmltree and apktool d do the same on the command line.

Can it convert resources.arsc to XML?

Yes. Drop resources.arsc, or the APK that contains it, and the whole table is written as XML, one line per resource and configuration with its id. Styles, arrays and plurals are listed but not expanded.

Why do some references stay as @0x0103… hex?

Those are Android framework resources (package 0x01). Their names live in the platform's android.jar, not in the APK, and aapt2 prints them as hex too. App resources (package 0x7f) are named from the APK's own resource table.

Does it work with AAB files?

Yes. The AAB manifest is stored as protobuf in base/manifest/AndroidManifest.xml; it is decoded and its references are named through base/resources.pb. The resource table itself is only dumped for APKs.

Updated