How to Decode, Edit, and Rebuild an APK with Apktool (and Sign It So It Installs)

TL;DR: APKTool decodes an APK into readable smali code and near-original resources, and rebuilds it after your changes. The full loop is apktool d app.apk -o app_out to decode, edit, then apktool b app_out -o rebuilt.apk to rebuild, followed by zipalign and signing before install. Use the current 3.0.3 release — most tutorials online still pin old 2.x versions. Only modify apps you own or have permission to test.

APKTool is the standard tool for taking an Android APK apart and putting it back together. It decodes the binary AndroidManifest.xml and resources into readable form, disassembles the DEX code into smali, and rebuilds a working APK from the decoded directory after you change something. It does not produce Java source (that is what JADX does), and the rebuilt APK is unsigned — signing is a separate step covered below.

Common legitimate uses: localizing an app’s strings, removing a permission you do not want an app to have, debugging a build by comparing decoded output across releases, and learning how Android packages are structured. The project’s own site states plainly that it is not intended for piracy — work only with apps you own or have permission to analyze and modify.

Use the current version

A practical warning before the commands: much of the advice online is outdated. Forum guides from the early 2010s still rank in search results, and several recent tutorials pin APKTool 2.9.3, which was already superseded. The current release is 3.0.3 (the last release of the 3.0 line, published on the project’s blog in July 2026), and version 3.0.2 from April 19, 2026 fixed CVE-2026-39973, an arbitrary file write during resource decoding. Staying on 2.x also has a functional cost: releases from 2.9.0 onward made aapt2 the default builder, and older versions cannot even decode APKs built with recent aapt2. There is no reason to install anything older than 3.0.3.

APKTool is a Java program. The only runtime requirement is Java 8 or higher (building APKTool itself from source needs a JDK, but the prebuilt release does not).

Install

The release blog publishes md5 and sha256 hashes for the jar. Verify the download against them before running it — the same hash-checking workflow from our APK verification guide applies to any tool in your toolchain. The published sha256 for the 3.0.3 jar is:

dbf930b076c6b9be08d57c449cacefc3bdd6b71ebd59b3066fc0e1f5b14f9423

Step 1: Decode the APK

apktool d app.apk -o app_decoded

d (or decode) unpacks the APK into a project-like directory. If you omit -o, the default output directory is apk.out. Useful options:

A full decode of a large app can take a minute or two. If you only want to inspect the code, add -r; if you only want the resources and manifest, add -s.

Step 2: Understand the decoded directory

Step 3: Make your changes

Two representative examples:

• Edit a string resource. Open res/values/strings.xml and change the value of a string, for example the app name or a visible label. This is the simplest possible rebuild test: decode, change one string, rebuild, install, and confirm the change.
• Patch smali. Locate the relevant .smali file under smali/ and edit an instruction or constant. Smali edits are unforgiving — one wrong register breaks the method — so start from the reading guide linked above before changing anything.

Keep changes small and verifiable: change one thing, rebuild, test, then move on. Renaming packages, swapping large resource sets, or editing apktool.yml are all possible but each multiplies the ways a rebuild can fail.

Step 4: Rebuild the APK

apktool b app_decoded -o rebuilt.apk

b (or build) recompiles the resources with aapt2 and repackages everything. Without -o, the output lands at dist/<name>.apk inside the decoded directory, where <name> comes from the original APK filename.

The -d flag is worth knowing for your own apps: it makes the rebuilt APK debuggable, which lets you attach a debugger or use adb shell run-as without editing the manifest by hand.

Step 5: Align and sign (required before install)

zipalign -p -f 4 rebuilt.apk rebuilt-aligned.apk
apksigner sign --ks my-key.keystore --out final.apk rebuilt-aligned.apk
adb install final.apk

zipalign (from the Android SDK build-tools) aligns uncompressed data on 4-byte boundaries; the -p flag aligns native libraries for page alignment. apksigner applies the signature — note that apps targeting Android 11 (API 30) or higher must be signed with the v2 signature scheme or newer on fresh installs, as explained in our guide to the APK signature schemes. A debug keystore generated by Android Studio is fine for testing your own rebuilds.

If adb install reports INSTALL_PARSE_FAILED_NO_CERTIFICATES, the APK was not signed. If it reports a signature mismatch against an installed copy, uninstall the original first — a rebuilt APK carries your signature, not the original developer’s, so the two cannot coexist as updates.

Troubleshooting common failures

Key takeaways

• Install 3.0.3, not 2.x. It is the current release (last of the 3.0 line), fixes a real arbitrary-file-write CVE from 3.0.2, and older versions cannot decode APKs built with recent aapt2.
• The loop is decode, edit, build, sign. apktool d, change one thing, apktool b, then zipalign and apksigner — the rebuilt APK is unsigned until you sign it.
• Use -r or -s to decode faster when you only need code or only need resources.
• Vendor system apps need their framework. apktool if framework-res.apk from the target device fixes most OEM decode failures.
• Only touch apps you own or are permitted to test. APKTool’s own documentation draws the line at piracy; this workflow is for research, localization, and debugging.

References

• APKTool official site — project homepage, install documentation, and the statement that the tool is not intended for piracy.
• Apktool 3.0.3 release notes — changelog, download hashes, and the note that 3.0.3 is the last release of the 3.0 line (published July 2026).
• APKTool XDA thread — 3.0.2 changelog including the CVE-2026-39973 arbitrary-file-write fix (April 19, 2026).