How to decompile an Android APK locally

Turn an APK into reconstructed Java, decoded resources and an evidence report on your computer. This workflow uses AppUnpack's local CLI and the JADX decompiler.

Start with the file and the right runtimes

You need an actual .apk file you are authorized to examine. An app name or Play Store URL does not contain the compiled app. Static analysis does not require installing the APK, connecting a phone or signing into an AI service.

Install Git, Node.js 24.11 or newer, npm and a Java 17 or newer JDK. Full export needs the JDK's compiler modules; a Java runtime alone is insufficient. Python 3.10 or newer is needed for the separate split-set, APK preflight and native-extraction workflows.

If the app arrived as .xapk, .apks or several APKs, follow the split APK and XAPK guide instead. One base APK may omit relevant classes or resources.

Install AppUnpack and verify the engine

git clone https://github.com/samalyxx/appunpack.git
cd appunpack
npm ci
node bin/appunpack.mjs install-tools
node bin/appunpack.mjs doctor

Run subsequent commands from this checkout. The installer downloads a pinned headless JADX engine and verifies its SHA-256. It does not install Java or Python. AppUnpack currently installs from source; there is no published npm release to fetch with npx.

doctor checks the selected Java/engine connection. It does not prove that every method in a target APK can be recovered. See installation and runtime selection if Java is missing or the wrong installation is selected.

Export the APK into a new directory

node bin/appunpack.mjs analyze ./Example.apk --output ./reports/example

Replace the input path with your APK. Quote paths containing spaces. The shorter command below creates an Example-analysis folder beside the APK:

node bin/appunpack.mjs ./Example.apk

On Windows, the equivalent PowerShell launcher is .\appunpack.ps1 'C:\Apps\Example.apk'. Analysis preserves an existing output directory rather than overwriting it. If an attempt fails, retain its logs and select a new destination before retrying.

Read the report before browsing code

Files produced by the APK export
Output	Use it for
`report.md`	Package summary, export status and limitations.
`evidence.json`	APK SHA-256, engine identity and collected responses.
`decompiled/sources/`	Recovered Java classes and methods.
`decompiled/resources/`	Decoded resources, including strings and layouts when available.
`manifest.xml`	Manifest declarations returned by the engine.
`decompiled/export.json` and `decompile.log`	Completion status, counters and diagnostics for incomplete output.

A partial export can still contain useful files. Check the specific method or resource your investigation depends on, rather than treating the total file count as proof of completeness. A manifest permission is a declaration, not evidence that the app exercises it at runtime.

Trace a class, method or reference

node bin/appunpack.mjs classes ./Example.apk Search
node bin/appunpack.mjs class ./Example.apk com.example.SearchActivity
node bin/appunpack.mjs method ./Example.apk com.example.SearchActivity search
node bin/appunpack.mjs references ./Example.apk com.example.SearchActivity --method-name search

The class and method names above are placeholders. Select actual names from your results. These commands return JSON; the class summary also lets you choose an overloaded method using --overload-index. See the command reference for source and resource queries.

Understand what APK decompilation cannot recover

Reconstructed Java is a derived view of compiled bytecode. It is not the original Kotlin/Java project or a guaranteed buildable application. Obfuscation, reflection, native libraries and unsupported constructs can leave gaps. An APK cannot provide the app's server-side implementation.

Keep the hash, diagnostics and uncertainty with each conclusion. The default CLI processes the target locally; an optional cloud MCP client can send requested tool output to its provider. Read the coverage table and verification record before relying on a result.