APK Toolbox

Track, clone, install and merge Android apps — right on the phone, no root.

APK Toolbox started as a way to get a second copy of an app next to the original and grew into a small set of tools for APK files. It follows in the steps of Obtainium, SAI and AntiSplit-M — what their authors made, brought together in one place, with a few things added:

• Sources — track apps from GitHub, GitLab, F-Droid, app stores, Telegram channels and other sites, and install their new versions straight from the source.
• Cloning — make a copy of an app under a new package name and app name, take away the permissions it should not have, and keep the clone in step with the original as it gets updated: seamlessly, with its data kept.
• A clone instead of the app — a tracked app can be installed as a clone only, without the permissions you switch off, and is updated from its source without the original ever being on the device.
• SAI — install split APKs (APKS, XAPK, APKM, ZIP) and export installed apps as .apks archives.
• AntiSplit — merge an app that ships as several APKs into one regular APK.

One schedule and one installation method serve all of it: what is found in the background is installed the same way whether it is a tracked app or a clone.

Nothing is left behind on disk: a result is either installed or saved where you choose, and temporary files are removed afterwards.

Two things it does that are hard to find elsewhere:

• Apps from Telegram channels. A channel that posts builds as files is tracked like a store: new files are found, downloaded and installed, in the background too.
• A clone instead of the app, kept up to date. An app can be installed only as a clone with the permissions you take away — no network, no contacts — and every new release is rebuilt the same way and installed over it, with the data kept. The original never has to be on the device.

Get the latest build from Releases. APK-Toolbox-<version>-universal.apk installs on anything; the others are smaller, one for each kind of processor (arm64-v8a for nearly every phone of the last years).

• Android 8.0 or newer. Updating without a prompt through the system installer needs Android 12; before that it takes Shizuku.
• Any processor: the universal APK installs everywhere, and there is a smaller one for each kind.
• No root needed.
• Shizuku is optional — it lets apps and clones update without any prompts.
• The interface speaks English, Русский, 中文, 日本語, العربية, Deutsch, Français, Español, Português (Brasil), Türkçe, 한국어, Italiano, Polski, Tiếng Việt, Bahasa Indonesia, Українська — pick yours in settings.

Install APK Toolbox and open it. It asks for two things: access to files and permission to install apps. After that the four tabs are ready to use. The i button on each tab says what the tab is for.

Add an app by the link to its page — a GitHub or GitLab repository, an F-Droid package, a store page, a Telegram channel, a direct link to an APK — or find it by name in the sources that can be searched (GitHub, GitLab, Codeberg, F-Droid, APKPure, Aptoide, Uptodown, RuStore, Tencent, CoolApk, Apk4Free and a few more). APK Toolbox then knows which version is the latest, shows what is new in it, and installs or updates the app on request or in the background.

• APK Toolbox itself is on the list from the first start, tracked from its GitHub releases, so it keeps itself up to date like everything else. Take it off the list and it stays off.
• Tap an app to see its versions and release notes, to Update or Remove it.
• Hold an app for everything else: check it now, change its options, give it categories, pin it, share its link, download a release file, or select several apps at once.
• Filter narrows the list by state, source and category.
• More settings when adding, and App options later, hold what a particular app may need: which file of a release to take, how to read its version, whether to update it automatically. Every option says what it does.

Access tokens, the choice of releases, the order of the list and import and export live under Sources settings. Lists are stored in the format of Obtainium, so they can be moved between the two apps in either direction, and obtainium:// links open in APK Toolbox.

When the build on the device is signed by someone else than the one being added — a fork next to the original, say — the new one cannot go over it. APK Toolbox says so on the app's page and tracks nothing yet: the list, and whatever was tracked under that package before, stays as it was. Delete current removes the installed build, after which the page is an ordinary install. A different link for a package that is tracked already asks before it replaces the source.

Channels that post apps as files can be tracked like any other source: add the link to the channel (https://t.me/name), or to a message with the file.

• The files of a channel cannot be read anonymously, so this needs an account: Sources settings → Telegram → Sign in, with a phone number or with a QR code scanned from another device. The session stays on the device, encrypted with a key of the Android Keystore, and Sign out removes it.
• A channel may post one app or hundreds. What is tracked is one kind of file: the releases that agree in the app's name and in the words that say which build it is (a clone, a beta, an architecture). The version is read from the file's name. A channel with several kinds asks which one to follow, in a list that can be searched; a link to a message says so by itself.
• A file named some other way is not taken for a release of the app. When an author starts naming files differently, the kind to follow can be changed in App options.
• Only a small part of a file is fetched to learn what app it is; the whole file is downloaded when it is installed.

1. On the Installed side pick an app, or tap Choose APK.
2. Adjust the package name and the app name. The defaults are <original>.clone and " Clone", or the next free number (.clone2, "Clone 2", …) if you have cloned the app before.
3. Leave Mark the icon with a dot on to tell the clone from the original on the home screen. Each clone gets its own colour. The dot is drawn on top of the app's own icon layers, so it works for apps of any size.
4. Permissions lists everything the app asks for; switch off what the clone should not have — the network, the contacts, the location. The clone is built without them, so the system never grants them.
5. Patches — optional changes to the clone's code. Every patch is applied only to the clone and can make the app crash; the list is short and each patch says what it does. See Patches below.
6. Tap Clone, then Install the result or Save it.

The clone is a separate app with its own data, installed side by side with the original. An app can be cloned as many times as you like.

The Clones side lists every clone you have installed. Tap one to see which app and version it was made from, to Update it to the original's current version or to Delete it.

• Updates are seamless. A new version of the original is cloned again under the same package and signed with the same key, so it installs over the clone like any ordinary update: the data, the sign-ins, the icon mark and the removed permissions all stay.
• Permissions can be changed at any time. Permissions takes permissions away from a clone, or gives them back, after it was made: the clone is built again and installed over itself, so its data is kept.
• A removed permission stays removed. The choice is remembered by name. If a release stops asking for a permission and a later one brings it back, it is taken away again; it stays in the list meanwhile, so it can be allowed again.

Refresh looks at every clone and its original again and brings the clones that are behind up to date one after another.

An app that asks for more than you want to give it — and cannot be denied the network, say — does not have to be installed at all. The page of a tracked app that is not installed has a switch, Install as a clone. Switched on, it shows what a clone is always made with — the package, the name, the mark on the icon and Permissions — and Install does the rest:

• Every release is downloaded, rebuilt as a clone — under the clone's package, without the permissions you switched off — and only the clone is installed. Choosing permissions is optional; nothing is asked on the way.
• The clone is updated from the source like any tracked app, in the background too, and every update is built without the same permissions. The original is never on the device.
• If the publisher's signing key changes between releases, the update is refused the way the system would refuse it for the app itself.

The two tabs then share the clone between them. Sources is about where it comes from and its updates; what it is made with is set on the clone's own page in Clones — Clone settings on the one page and Show in Sources on the other lead across. Changing the permissions of an installed clone rebuilds it from itself and the manifest kept from its original, so nothing is downloaded again, and installs it over itself with its data. A release that asks for a permission no earlier one had is listed on the app's page as New permissions.

An app that is installed already has Reinstall as a clone instead of the switch. A clone is a separate app that starts empty — data and sign-ins do not move over — so this asks first. The clone is built from the app that is on the device, with nothing downloaded, and Delete the original says whether that app goes afterwards: it is removed only once the clone is installed, so a "Cancel" in the system's dialog loses nothing. Nothing about the app changes until then: leave the page without installing, and the app stays what it was. Back to the original removes the clone, with everything in it, and installs the app as its publisher made it.

A clone made from an installed app is rebuilt from that app, so it stops being updated when the original is removed. The Clones list says where each clone gets its updates: From the original, From a source, or No original. Google Play hands its files to nobody else, but the same builds are carried by other stores: Update from a source on a clone's page looks the app up by its package in APKPure, RuStore, Galaxy Store and others, one after another, and has the clone kept up to date from the first that has it, in the Sources tab. The original can then be removed. A clone of an app you track already is picked up the same way when its switch is turned on. An update signed by someone else than the installed original is refused.

Do not update, at the bottom of a tracked app's page and of a clone's, keeps it at the version it has: nothing offers or installs a newer one, and the list says so next to the version. Filter on both tabs picks apps by any of the chosen kinds — with an update, not updated, originals or clones, from the original or from a source — by source and by category; All switches every chip of a group on or off. Categories are shared between the tabs; a clone is filed under them by holding its row.

A clone is signed with APK Toolbox's key, not the publisher's: sign-in with Google, payments and integrity checks may not work in it.

A patch is a change to the clone's code, made while it is built. The picker lives behind the Patches button of a clone draft and of a clone's own page; each patch can be switched on or off at any time, and a change rebuilds the clone over itself, with its data kept. Every patch is applied only to the clone — the original is never touched.

One group of settings covers both tracked apps and clones:

• Check for updates — a background check, from once a day to once a year, for Apps from sources, Clones or both. It survives reboots. On its own it only notifies. Check now runs it at once and reports everything that is waiting.
• Install automatically — install what was found without asking. Wait for Wi-Fi and Wait for the charger hold an update back until the condition is met and then install it by themselves.
• Installation method:
  • Standard — the system installer. Without a prompt it updates only what APK Toolbox installed itself and what targets a recent Android version. Clones, being re-signed, are additionally held back while Google Play Protect app scanning is on.
  • Shizuku — installs with shell privileges, with no prompts, for any app. After a reboot the check waits for Shizuku to be started.

Check when the app opens is separate from the schedule: with it on, tracked apps and clones are looked at again every time APK Toolbox is opened.

Whatever could not be updated automatically is reported in a notification. An install you start by hand always goes through the system installer.

Installing through root is available as an experimental switch. It has not been tested on a rooted device.

• Choose APKS installs a bundle (APKS, XAPK, APKM, ZIP), several split APK files or a single APK as one app. Pick which splits to include — all of them, or only those this device needs — and optionally re-sign them first. OBB expansion files inside an XAPK are copied to where the app expects them.
• Tap an installed app to Export it as an .apks archive. The archive carries the icon and metadata in the format SAI defined, so other tools recognise it.

Turns an app that ships as several APKs into a single regular APK.

• Pick an installed split app, tap Choose split APK files, or share / open the files into APK Toolbox from another app.
• Choose the splits: all, or only the ABI, screen density and language this device uses.
• Merge, then install or save the result as <name>_antisplit.apk.

Splits whose version or package differs from the base are refused unless you allow merging them anyway. Apps protected by PairIP are left unsigned, since a re-signed build of such an app would not start.

Merging decodes the app's resource tables in memory, which takes about twenty times their size, and Android caps what an app may use. Apps whose tables come to more than roughly 20 MB are therefore refused with a message rather than merged; those are better merged on a computer with APKEditor.

Everything APK Toolbox produces has to be signed, and the original signature cannot be kept: it stops matching as soon as the APK is modified. Out of the box a built-in key is used. It is the same for every copy of the app and its private half is in this repository, so anyone could sign with it.

In settings you can Create a key of your own or Import one from a PKCS#12 (.p12, .pfx) or BKS keystore. Your key is stored encrypted in the app's private storage. Export it and keep the file: clones can only be updated with the key they were signed with, and the key is gone if the app is uninstalled. Clones made with the built-in key keep updating with it.

Every release APK is signed with the author's key. Verify it before installing — for example with apksigner verify --print-certs app.apk — against:

• Package name: io.github.bl3xand.apkcloner
• SHA-256 hash of signing certificate:

06:95:1F:0B:6F:94:7D:C0:C1:CD:C2:AC:CF:C7:9B:3B:DB:9F:6D:B1:57:6E:23:D7:94:68:EE:25:58:26:6A:4C

Clones you build yourself are signed with the built-in key or your own — that is a different certificate and a different story, see above.

• A merged APK is signed with a different key than the original from a store, so it cannot be installed over it — the original has to be removed first.
• Google Play Protect treats re-signed apps as unknown and may block them, including installs you start by hand. It may also object to APK Toolbox itself, as an app that installs other apps.
• Cloning changes the manifest and the package name in the resource table, nothing else. Apps that check their own package name or signature, and services bound to them (Google sign-in, Firebase, in-app purchases), may not work in a clone.
• A cloned app made of split APKs is saved as a single .apks archive.

Settings → Show log tells what the app did and what failed: checks, downloads, clones, merges, installs, changes of settings. It is kept for 30 days, can be narrowed to a period and to any set of levels, and Save writes the whole history to a .log file — attach that file to an issue and it says what happened: every step of every build, install and download, with the reasons in the system's own words.

./gradlew assembleRelease

This makes one APK for each kind of processor and a universal one that has them all, in app/build/outputs/apk/release/. A release build is shrunk and obfuscated with R8. It is signed if a keystore.properties file (storeFile, storePassword, keyAlias, keyPassword) is present in the project root, and left unsigned otherwise.

Telegram channels need the app's own API id and hash from my.telegram.org. Copy telegram.properties.example to telegram.properties and fill them in; the file stays out of git. Without it the app builds and the Telegram source says it is not available.

APK Toolbox stands on other people's work. It is not an attempt to replace any of these apps, and it is made with respect for the effort that went into them — the author simply finds it convenient to have everything in one place. If one of these tools does all you need, use it and support its author.

⭐ Obtainium by ImranR98 — the Sources tab is a port of it: the sources, the update checks, the storage format and most of the texts

⭐ AntiSplit-M by AbdurazaaqMohammed — the split merging feature follows its functionality

• APKEditor and ARSCLib by REAndroid — the merge itself
• SAI by Aefyr — the model for installing split APKs and the .apks export format
• Shizuku by RikkaApps — installing without prompts
• TDLib, in the Android build by tdlibx — reading and downloading the files of Telegram channels
• ZXing — the QR code of a Telegram sign-in
• apksig from the Android Open Source Project — signing APKs
• jsoup, jBCrypt, Apache Commons Compress and XZ for Java — reading what the sources publish

Licensed under GPL-3.0. The Sources tab derives from Obtainium, which is published under the same licence.