What an APK is, physically
An APK is a ZIP archive with a fixed layout: AndroidManifest.xml (in a compiled binary format, not text), classes.dex (the app's code), resources.arsc and res/ (icons, strings, layouts), assets/ (arbitrary files — for a site built from a ZIP, your site lives in assets/web/), and a signature. The inspector opens that archive, decodes the binary manifest and reads the signature, all in your browser.
The fields worth checking before you share a build
| Field | Why it matters |
|---|---|
package | The app's permanent identity. Google Play, Android and every user's installed copy key on it. It can never change for a published app. |
versionCode | An integer every update must increase. Android refuses to install an APK over one with a higher versionCode. |
versionName | What users see ("1.4.2"). Free text; does not affect updates. |
minSdkVersion | The oldest Android the app installs on. 21 means Android 5.0. |
targetSdkVersion | The Android behaviour the app opts in to. Google Play requires a recent target for new apps and updates. |
debuggable | Must be false for release. Play rejects debuggable uploads. |
| Permissions | What the app may request. Runtime ones (camera, location, microphone) are still asked for at the moment of use. |
Signing schemes and fingerprints
Android has used several signature formats: v1 (JAR signing, files in META-INF/), v2 (Android 7+, a signing block covering the whole file) and v3/v3.1 (Android 9+, adds key rotation). A modern APK usually carries v2 and v3; v1 is added when the app supports Android versions older than 7.
The certificate's SHA-256 and SHA-1 fingerprints are what other services use to recognise your app: Firebase (for Google Sign-In, Dynamic Links and App Check), the Google Cloud console for Maps and OAuth clients, and assetlinks.json for Android App Links. Copy them from here instead of installing the JDK to run keytool.
Google Play re-signs your app. With Play App Signing, the APK users download is signed with Google's app signing key, not the upload key you signed the AAB with — so it has a different fingerprint. Register both fingerprints with Firebase: the upload key's (from your APK or keystore) and the app signing key's (Play Console → Setup → App integrity).
Is the APK uploaded?
No. The file is read with FileReader, the manifest and the ASN.1 certificate are parsed in JavaScript, and fingerprints are computed with the browser's built-in Web Crypto. Nothing leaves your machine.