Who Jadx is for#
Security researchers auditing Android apps
Jadx decompiles an APK to readable Java in one command, letting you review permission handling, API calls, data storage patterns, and authentication logic directly. The GUI's find-usage and full-text search make it fast to locate specific classes or string patterns across a large codebase.
Skip if:
If the target app uses advanced custom obfuscation that defeats jadx's deobfuscator, the output may be incomplete. For those cases, a commercial Android analysis tool with stronger obfuscation handling is a better fit.
Penetration testers doing mobile app assessments
Extract hardcoded API keys, credentials, or sensitive endpoints from an APK during a mobile pentest engagement. Jadx outputs a Gradle project you can build and modify, useful for testing tampering-based attacks or identifying client-side checks that can be bypassed.
Skip if:
If your engagement timeline is short and the app is heavily obfuscated, the time spent working around jadx's decompilation gaps may exceed what is practical. A commercial tool with stronger obfuscation handling may be worth the cost for these engagements.
CTF competitors analyzing DEX payloads
Quickly decompile DEX or APK challenges to readable Java without installing multiple tools. Jadx-gui's full-text search and jump-to-declaration navigation speed up flag hunting in code you have never seen before. No license required, no setup beyond a Java runtime.
Developers recovering code from compiled APKs
When the original source repository is unavailable or a release build predates your codebase backup, jadx reconstructs Java source with enough fidelity to recover business logic. The Gradle export option produces a project you can import directly into IntelliJ or Android Studio.
Skip if:
Jadx cannot recover comments, variable names stripped below the deobfuscation threshold, or code removed before compilation. If you need complete source reconstruction, a commercial tool with deeper obfuscation analysis is worth evaluating.
The problem it solves#
Compiled Android apps ship as APK files containing Dalvik bytecode that cannot be read directly. When you need to audit a third-party app for security vulnerabilities, investigate suspected malware, understand how a library implements a specific behavior, or recover code from a build you no longer have source for, the binary format is a wall.
Professional Android reverse engineering tools that produce clean, navigable Java output have historically sat behind commercial licenses. JEB Decompiler, the primary paid option, carries significant licensing costs that put it out of reach for independent researchers, small security teams, and CTF competitors. Free alternatives produced lower-quality output or lacked the interactive tooling needed to work through a large codebase efficiently.
How it solves it#
APK, DEX, and AAB Decompilation
Converts compiled Android binaries into readable Java source code. Supports APK, DEX, AAB, APKS, APKM, XAPK, and ZIP input formats, plus JAR, class, and AAR files for Java bytecode. Output can be saved as standard Java files or exported as a Gradle project for further editing in Android Studio or IntelliJ.
jadx-gui: Interactive Code Viewer
A desktop graphical interface with syntax-highlighted Java output, jump-to-declaration navigation, find-usage search, and full-text search across all decompiled files. The GUI makes it practical to navigate large APKs without scripting. Key bindings are configurable via a dedicated reference in the project wiki.
Built-in Deobfuscator
Renames short or garbled class, method, and field names to more readable generated names automatically. Deobfuscation mappings persist across sessions via a JOBF file. External mapping files in Tiny, Enigma, ProGuard, SRG, and other formats can be loaded to restore original names when available.
Smali Debugger
A debugger for Dalvik bytecode (smali) built into jadx-gui. Step through bytecode execution to understand control flow and runtime behavior, useful for analyzing apps where the decompiled Java output is incomplete or misleading due to obfuscation. Setup instructions are in the project wiki.
AndroidManifest.xml and Resource Decoding
Decodes AndroidManifest.xml from the binary XML format to human-readable form, and extracts string, layout, and other resource files from the APK's resources.arsc. Covers both code and resource inspection in a single pass, without requiring a separate resource-decoding tool.
Plugin System
Jadx includes a plugin manager for installing, enabling, disabling, and updating plugins from the built-in marketplace. Plugins extend file format support and decompilation behavior without modifying the core. The plugins command lists available and installed plugins and supports per-plugin version control.
Strengths and trade-offs#
Strengths
- Apache-2.0 License, No CostJadx is Apache-2.0 licensed and free to use commercially, modify, and distribute. Unlike JEB Decompiler, which requires a paid commercial license, jadx imposes no licensing fees for any use case, including professional security engagements, internal tooling, and consulting work.
- 51,000+ Stars, Actively MaintainedWith over 51,000 GitHub stars and regular commits (last push October 2026), jadx is the most widely adopted open source Android decompiler. Active maintenance means compatibility with new Android versions and DEX format changes is addressed regularly, not left to rot.
- Both CLI and GUI in One PackageThe same release zip ships both the command-line tool and jadx-gui. The CLI is scriptable for batch decompilation pipelines; the GUI handles interactive analysis. Most paid Android analysis tools either charge separately for GUI tooling or require separate installations.
- Broad Format SupportHandles APK, DEX, AAB, APKS, APKM, XAPK, ZIP, JAR, class, AAR, and smali inputs. A single tool covers most formats encountered in Android reverse engineering, reducing the need for format conversion steps before analysis can begin.
Trade-offs
- -Decompilation Is Not 100% AccurateThe README explicitly warns that jadx cannot decompile 100% of the code in most cases, and errors will occur. Complex control flow, certain obfuscation patterns, and edge-case bytecode can produce output that does not compile or is logically incorrect. A troubleshooting guide in the wiki covers common workarounds, but some code will require manual reconstruction.
- -458 Open IssuesThe project has 458 open GitHub issues as of late 2026. Most are edge-case decompilation failures, format-specific quirks, or feature requests, but the volume indicates that advanced use cases will hit unresolved bugs. Users requiring guaranteed decompilation accuracy for complex targets should evaluate commercial alternatives before committing to jadx.
- -No Built-in Scripting ConsoleJadx can be used as a Java library via its documented API (wiki), but it ships no interactive scripting console. Automation beyond batch CLI use requires writing Java code or building against the library interface, which is a higher bar than the scripting surfaces offered by some commercial Android analysis tools.
Jadx vs alternatives#
Jadx vs JEB Decompiler
Jadx and JEB Decompiler both target Android reverse engineering. Jadx is open source and free under the Apache-2.0 license; JEB is a commercial product with paid proprietary licensing.
| Feature | Jadx | JEB Decompiler |
|---|---|---|
| License | Apache-2.0 | Proprietary (commercial) |
| Cost | Free | Paid |
| Runs locally | Yes | Yes |
| GUI included | Yes (jadx-gui) | Yes |
| CLI | Yes | Yes |
| Deobfuscation | Built-in auto-rename | Yes |
| Smali debugger | Yes (jadx-gui) | Yes |
| Format support | APK, DEX, AAB, JAR, and more | APK, DEX, AAB, and more |
Jadx covers the core decompilation workflow at no cost and is the default starting point for most Android reverse engineering work. Its Apache-2.0 license allows commercial use without restriction, which matters for professional security teams and independent consultants.
JEB Decompiler is a paid commercial tool. Its licensing cost makes it harder to justify for individual researchers, CTF competitors, or small security teams. For most standard Android analysis tasks, jadx's output is sufficient to understand app logic, identify vulnerabilities, and extract sensitive data.
JEB is worth evaluating when your targets are heavily obfuscated, when decompilation accuracy gaps in jadx are unacceptable for your use case, or when you need commercial-grade support with dedicated engineering behind the tool. Choose jadx for standard Android reverse engineering without licensing overhead; consider JEB when analysis complexity or support requirements justify the cost.
Quick start#
Install jadx using a package manager; Java 11 or later is required on your system.
```bash
# macOS
brew install jadx
# Arch Linux
sudo pacman -S jadx
# Linux (Flatpak)
flatpak install flathub com.github.skylot.jadx
```What it's built on#
- Languages
- JavaKotlin
FAQ#
Is jadx free to use for commercial security work?
Yes. Jadx is Apache-2.0 licensed, which permits commercial use, modification, and distribution with no restrictions. You can use it in paid security engagements, internal tooling, and consulting work without paying a license fee.
Can jadx decompile 100% of an Android APK?
No. The README explicitly states that jadx cannot decompile 100% of the code in most cases, and errors will occur. Complex control flow, aggressive obfuscation, and certain bytecode patterns produce incomplete or incorrect output. The project wiki has a troubleshooting guide for common decompilation issues.
What Android and Java file formats does jadx support?
Jadx accepts APK, DEX, AAB, APKS, APKM, XAPK, ZIP, JAR, class, AAR, and smali inputs. It also decodes AndroidManifest.xml and binary resource files from resources.arsc, so a single run covers both code and resource inspection.
How do I install jadx?
On macOS, run brew install jadx. On Arch Linux, run sudo pacman -S jadx. On Linux desktops with Flatpak, run flatpak install flathub com.github.skylot.jadx. For other platforms, download the latest release zip from GitHub, unpack it, and run the jadx or jadx-gui binary from the bin directory. Java 11 or later is required.
How does jadx compare to JEB Decompiler?
Jadx is free and open source under Apache-2.0; JEB Decompiler is a commercial tool with paid proprietary licensing. For standard decompilation of non-obfuscated or lightly obfuscated APKs, jadx produces output suitable for most security analysis work. JEB is a paid commercial alternative aimed at enterprise security teams with complex targets or requirements for commercial-grade support. Most independent researchers and small security teams find jadx sufficient for day-to-day work.
Similar open-source tools#
ASC
2,477 GitHub starsZero-overhead Android decompiler for mobile security researchers
Alternative to
JEB Decompiler
REA (Reverse Engineer Anything)
303,289 GitHub starsAI-powered reverse engineering for binaries, apps, and assemblies.
Alternative to
RevEng.AI
Statlite
172 GitHub starsSelf-hosted Spring Boot monitoring, no Prometheus or Grafana needed
Oxynote
214 GitHub starsTechnical wiki with live metrics, draft reviews, and real-time editing
Alternative to
Notion
iFixAi
29,142 GitHub starsSelf-hosted AI agent auditing across 60 trust and safety inspections.
Alternative to
Zenity
Gitdrive
128 GitHub starsYour GitHub repos as a native drive in macOS Finder
Alternative to
iCloud Drive