Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 19, 2026

Utilities

Inspect Java reconstructed from an Android APK

jadx-decompile is an offline APK decompilation adapter around JADX.

Agent
Inspect a known classReview embedded constantsCompare with smali

overview

What jadx-decompile does

Reconstruct Java sources and resources from one local APK for static inspection. JADX interprets bytecode; the result may be incomplete and is not the original source.

A folder containing native JADX Java sources and resources. The adapter requires Java source with the pinned JADX DEX-loaded marker; resource-only Java output is refused. Output above 4000 files or 64 MiB is rejected.

The current adapter checks ZIP file size up to 20 MiB, entry count up to 2000 and a declared expanded total up to 64 MiB. It rejects repeated raw paths, absolute paths, parent traversal and symlink entries. Normalized path aliases and inconsistent archive metadata remain under targeted review. Native execution has a 90-second timeout; output-size checks occur after the native process finishes and do not establish peak memory or temporary-disk containment.

Packaged upstream version: 1.5.6. The native CLI is Apache-2.0; the custom first-party adapter has separate proprietary licensing. The source/notices download includes the adapter, recipe, applicable dependency locks, pinned upstream references and installed notices.

source github.com/skylot/jadx/tree/28ff15e4ae69950aebea110a13e5ab895d234dfc

use cases

Where jadx-decompile fits

Inspect a known class

Read reconstructed Java alongside the original package during an owned-app review.

Review embedded constants

Locate a known marker or string in the Java output and inspect the surrounding logic.

Compare with smali

Use Apktool separately when a bytecode-level view helps explain incomplete decompilation.

reference

jadx-decompile inputs and flags

1 inputs
NameTypeFlagDescription
apkFILE--apkLocal APK ZIP file: at most 20 MiB, 2000 entries and 64 MiB declared expanded. Must contain AndroidManifest.xml and classes.dex.

Showing key inputs. jadx-decompile exposes 1 inputs in total.

example

Run jadx-decompile

jadx-decompile · command
python3 /app/run.py --apk ./owned-demo.apk ./output
sample output
package org.trickest.fixture;

/* JADX INFO: loaded from: classes.dex */
public class Fixture {
    public static String endpoint() {
        return "https://fixture.invalid/api/v1";
    }
}

guidance

Choosing jadx-decompile

Choose Apktool when smali disassembly and decoded resources suit the review. This operation reconstructs Java instead. It does not rebuild or execute the app.

faq

jadx-decompile questions

Local APK ZIP file: at most 20 MiB, 2000 entries and 64 MiB expanded. Must contain AndroidManifest.xml and classes.dex.

A folder containing native JADX Java sources and resources. The adapter requires Java source with the pinned JADX DEX-loaded marker; resource-only Java output is refused. Output above 4000 files or 64 MiB is rejected.

The current adapter checks ZIP file size up to 20 MiB, entry count up to 2000 and a declared expanded total up to 64 MiB. It rejects repeated raw paths, absolute paths, parent traversal and symlink entries. Normalized path aliases and inconsistent archive metadata remain under targeted review. Native execution has a 90-second timeout; output-size checks occur after the native process finishes and do not establish peak memory or temporary-disk containment.

Choose Apktool when smali disassembly and decoded resources suit the review. This operation reconstructs Java instead. It does not rebuild or execute the app.

Yes. The public Library entry uses the same ID as the accepted private fixture-tool-verifier run. Public image and source/notices downloads are verified. The sample comes from the owned platform fixture; it does not establish compatibility with every application.

The public image repository provides immutable image and ORAS download commands, an exact source/notices bundle checksum and pinned upstream source directions. The bundle retains the custom adapter, Dockerfile, applicable locks, installed notices and embedded Java notices where applicable. Java bundles also include the exact official Debian OpenJDK source descriptor and payloads. First-party adapter licensing is separate from upstream licensing. Follow the published local-tag alias instructions to reproduce the native fixture without a GHCR account. Image, source and license notice downloads.

related

More Utilities tools

  1. browser-fetch

    Headless Chromium render: requested URL, final URL, status, and title next to the page.

  2. cewl

    Spider a URL and return a wordlist for password crackers.

  3. csvkit

    SQL on one CSV. The table name is the file stem.

  4. dnsgen

    Wordlist and mined-word subdomain permutation.

  5. duckdb

    In-process SQL on CSV, JSON, and Parquet. No server.

  6. edge-tts

    Microsoft Edge neural speech from text or a script file. No API key.

Run jadx-decompile yourself

Retained Fixture.java downloaded from an actual private fixture-tool-verifier workflow on the accepted outputfix1 image. All three nodes succeeded, and the verifier confirmed the known URL and DEX-loaded marker. Separate local malformed-DEX testing showed upstream exit zero with resource-only output; the adapter rejects it with exit 2. This is adapter rejection, not upstream native failure. The public Library entry retains the same tested tool ID.

Open jadx-decompile in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.