JADX Android DecompilerStep-by-step reference: decompile APKs to Java with JADX GUI & CLI. Authorized apps only.FAQ

What is JADX?

JADX is a free, open-source Android decompiler by Skylot. It turns APK, DEX, and AAR files back into readable Java source with a fast GUI and a batch CLI.

Is using JADX legal?

JADX itself is legitimate open-source software. Decompiling apps without the owner written permission may break laws and licenses. Analyze only your own apps, open-source apps, or signed targets.

How do I install JADX?

Run sudo apt install jadx -y or unzip a release build and run bin/jadx-gui. Java 17 or newer is required.

How do I find secrets in an APK?

Open it in jadx-gui and global-search for http, api_key, secret, and password. Follow each hit into its class to confirm how the value is used.

How does JADX pair with MobSF?

MobSF flags issues fast; JADX confirms them to the exact line and reveals surrounding logic. Use both: scan broadly, then read deeply.

What if the code is obfuscated?

Rename symbols as you go and rely on strings, resources, and API call shapes. Secrets and endpoints survive most obfuscation.

Can I diff two app versions?

Yes. Batch-decompile both with the CLI into separate folders and diff them — new endpoints and permissions stand out immediately.

Why does the GUI run out of memory?

Large APKs need heap. Raise memory in the launch script or decompile headless with the CLI and browse the output.

All tools · Sitemap · Games