What an APK file is

An APK (Android Package Kit) is the file format Android uses to distribute and install apps. It is a compressed ZIP archive that holds everything an app needs to run: compiled code, resources, native libraries, and a manifest that tells the Android system what the app is allowed to do. When you download an app from a store or a website, what you are actually downloading is an APK, or a file that generates one.

What is inside an APK

An APK is a ZIP archive with a specific internal layout. Its essential parts are:

• AndroidManifest.xml: the app’s declaration of permissions, components (activities, services, receivers), and the minimum and target Android versions. This is the file that tells Android what the app is allowed to do.
• classes.dex: compiled executable code (Dalvik bytecode) that the Android runtime runs.
• resources.arsc: a compiled table that maps resource IDs to strings, colours, and layouts.
• res/: compiled resources such as images, layouts, and XML files.
• META-INF/: signing certificate and, in v1 signing, the manifest digest.
• lib/: native code libraries for different CPU architectures (armeabi-v7a, arm64-v8a, x86, x86_64).
• assets/: raw files the app reads, such as databases, fonts, or JavaScript bundles.

The manifest

The manifest is the most important file for safety questions. It lists every permission the app requests, the minimum Android version it supports, and the components it can expose to other apps. When you install an APK, Android reads this file to ask you for each permission. A mismatch between what the app says it does and the permissions it requests is a warning sign. For example, a simple flashlight app asking for access to your contacts is a red flag, regardless of whether it came from an official store. OWASP Mobile Application Security (OWASP MASVS) recommends reviewing the permissions an app requests before granting them, because a permission is a capability, not a guarantee of intent.

The signature

The signature is a cryptographic certificate embedded in the APK that binds the file to a signing key. Android uses it to verify that an update to an existing app comes from the same developer who signed the original. The signature does not tell you who the developer is in the real world; it only proves that the same key signed both versions. This is an identity chain, not a reputation score. Android’s package manager will refuse to install an update if the signature does not match the existing app’s signature. Modern signing schemes cover the entire file, so modifying an APK without breaking the signature is extremely difficult.

The code and resources

The code inside an APK is compiled to DEX bytecode, not a single executable in the way a Windows .exe is. Resources (images, layouts, strings, and configuration files) are stored in a separate binary format inside the res/ directory. The package name is the unique identifier, not the app label you see on the launcher.

How Android runs an APK

Android is the operating system that runs these packages. When you install an APK, the Android package installer checks the file’s signature, verifies the manifest, and places the app in a sandboxed environment. It does not “run” an APK directly; it extracts the package, validates it, and then runs the code from a dedicated app sandbox. This is why the same APK can be installed on different Android devices, as long as the device meets the app’s required Android version and hardware features.

Android App Bundle: the publishing format

An Android App Bundle (AAB) is the publishing format developers upload to Google Play. The store uses it to generate optimised APKs for each device configuration (screen density, CPU architecture, language). You never install an AAB directly on a phone; what you install is the APK that Google Play produces from it. The Android Developers documentation (2024) describes the App Bundle as a publishing format, not an installation format.

This distinction matters when you see a file ending in .aab: it is not an installable file for a normal user. When you download an app from Google Play, you receive an APK that was generated from the bundle for your specific device. Two phones can download the “same” app and receive different APK files.

What this means for APKs outside the Play Store

If you see a single APK file distributed outside the Play Store, it may be a universal APK that works on most devices, but it may not be optimised for your device. The file will still install, but it may be larger and, in rare cases, contain code paths that are not tested on your hardware.

How to inspect an APK before installing

The file extension is .apk. The format is a ZIP archive, so you can open it with any ZIP tool to see its contents. When you inspect an APK, check the manifest first: it tells you what the app asks for, before it runs on your device. Look at the permissions list and ask whether each permission matches the app’s stated purpose. Then check the signature information in META-INF/ to confirm the file has not been tampered with since it was signed.