Jadx

Open source alternative to JEB Decompiler

51.1K stars
Apache-2.0
Active this week
Last commit 7 days ago

Last verified Oct 20, 2026

Convert Android APK, DEX, and AAB files into readable Java source code with a free CLI and GUI decompiler that includes built-in deobfuscation.

Visit website GitHub51.1K

Read the full breakdownWho it is for, how it works, trade-offs, the quick start and the FAQ

who it's for

Who Jadx is for#

Security researchers auditing Android apps

Jadx decompiles an APK to readable Java in one command, letting you review permission handling, API calls, data storage patterns, and authentication logic directly. The GUI's find-usage and full-text search make it fast to locate specific classes or string patterns across a large codebase.

Skip if:

If the target app uses advanced custom obfuscation that defeats jadx's deobfuscator, the output may be incomplete. For those cases, a commercial Android analysis tool with stronger obfuscation handling is a better fit.

Penetration testers doing mobile app assessments

Extract hardcoded API keys, credentials, or sensitive endpoints from an APK during a mobile pentest engagement. Jadx outputs a Gradle project you can build and modify, useful for testing tampering-based attacks or identifying client-side checks that can be bypassed.

Skip if:

If your engagement timeline is short and the app is heavily obfuscated, the time spent working around jadx's decompilation gaps may exceed what is practical. A commercial tool with stronger obfuscation handling may be worth the cost for these engagements.

CTF competitors analyzing DEX payloads

Quickly decompile DEX or APK challenges to readable Java without installing multiple tools. Jadx-gui's full-text search and jump-to-declaration navigation speed up flag hunting in code you have never seen before. No license required, no setup beyond a Java runtime.

Developers recovering code from compiled APKs

When the original source repository is unavailable or a release build predates your codebase backup, jadx reconstructs Java source with enough fidelity to recover business logic. The Gradle export option produces a project you can import directly into IntelliJ or Android Studio.

Skip if:

Jadx cannot recover comments, variable names stripped below the deobfuscation threshold, or code removed before compilation. If you need complete source reconstruction, a commercial tool with deeper obfuscation analysis is worth evaluating.

the problem

The problem it solves#

Compiled Android apps ship as APK files containing Dalvik bytecode that cannot be read directly. When you need to audit a third-party app for security vulnerabilities, investigate suspected malware, understand how a library implements a specific behavior, or recover code from a build you no longer have source for, the binary format is a wall.

Professional Android reverse engineering tools that produce clean, navigable Java output have historically sat behind commercial licenses. JEB Decompiler, the primary paid option, carries significant licensing costs that put it out of reach for independent researchers, small security teams, and CTF competitors. Free alternatives produced lower-quality output or lacked the interactive tooling needed to work through a large codebase efficiently.

how Jadx solves it

How it solves it#

APK, DEX, and AAB Decompilation

Converts compiled Android binaries into readable Java source code. Supports APK, DEX, AAB, APKS, APKM, XAPK, and ZIP input formats, plus JAR, class, and AAR files for Java bytecode. Output can be saved as standard Java files or exported as a Gradle project for further editing in Android Studio or IntelliJ.

jadx-gui: Interactive Code Viewer

A desktop graphical interface with syntax-highlighted Java output, jump-to-declaration navigation, find-usage search, and full-text search across all decompiled files. The GUI makes it practical to navigate large APKs without scripting. Key bindings are configurable via a dedicated reference in the project wiki.

Built-in Deobfuscator

Renames short or garbled class, method, and field names to more readable generated names automatically. Deobfuscation mappings persist across sessions via a JOBF file. External mapping files in Tiny, Enigma, ProGuard, SRG, and other formats can be loaded to restore original names when available.

Smali Debugger

A debugger for Dalvik bytecode (smali) built into jadx-gui. Step through bytecode execution to understand control flow and runtime behavior, useful for analyzing apps where the decompiled Java output is incomplete or misleading due to obfuscation. Setup instructions are in the project wiki.

AndroidManifest.xml and Resource Decoding

Decodes AndroidManifest.xml from the binary XML format to human-readable form, and extracts string, layout, and other resource files from the APK's resources.arsc. Covers both code and resource inspection in a single pass, without requiring a separate resource-decoding tool.

Plugin System

Jadx includes a plugin manager for installing, enabling, disabling, and updating plugins from the built-in marketplace. Plugins extend file format support and decompilation behavior without modifying the core. The plugins command lists available and installed plugins and supports per-plugin version control.

strengths · trade-offs

Strengths and trade-offs#

Strengths

Apache-2.0 License, No CostJadx is Apache-2.0 licensed and free to use commercially, modify, and distribute. Unlike JEB Decompiler, which requires a paid commercial license, jadx imposes no licensing fees for any use case, including professional security engagements, internal tooling, and consulting work.
51,000+ Stars, Actively MaintainedWith over 51,000 GitHub stars and regular commits (last push October 2026), jadx is the most widely adopted open source Android decompiler. Active maintenance means compatibility with new Android versions and DEX format changes is addressed regularly, not left to rot.
Both CLI and GUI in One PackageThe same release zip ships both the command-line tool and jadx-gui. The CLI is scriptable for batch decompilation pipelines; the GUI handles interactive analysis. Most paid Android analysis tools either charge separately for GUI tooling or require separate installations.
Broad Format SupportHandles APK, DEX, AAB, APKS, APKM, XAPK, ZIP, JAR, class, AAR, and smali inputs. A single tool covers most formats encountered in Android reverse engineering, reducing the need for format conversion steps before analysis can begin.

Trade-offs

-Decompilation Is Not 100% AccurateThe README explicitly warns that jadx cannot decompile 100% of the code in most cases, and errors will occur. Complex control flow, certain obfuscation patterns, and edge-case bytecode can produce output that does not compile or is logically incorrect. A troubleshooting guide in the wiki covers common workarounds, but some code will require manual reconstruction.
-458 Open IssuesThe project has 458 open GitHub issues as of late 2026. Most are edge-case decompilation failures, format-specific quirks, or feature requests, but the volume indicates that advanced use cases will hit unresolved bugs. Users requiring guaranteed decompilation accuracy for complex targets should evaluate commercial alternatives before committing to jadx.
-No Built-in Scripting ConsoleJadx can be used as a Java library via its documented API (wiki), but it ships no interactive scripting console. Automation beyond batch CLI use requires writing Java code or building against the library interface, which is a higher bar than the scripting surfaces offered by some commercial Android analysis tools.

versus alternatives

Jadx vs alternatives#

Jadx vs JEB Decompiler

Jadx and JEB Decompiler both target Android reverse engineering. Jadx is open source and free under the Apache-2.0 license; JEB is a commercial product with paid proprietary licensing.

Feature	Jadx	JEB Decompiler
License	Apache-2.0	Proprietary (commercial)
Cost	Free	Paid
Runs locally	Yes	Yes
GUI included	Yes (jadx-gui)	Yes
CLI	Yes	Yes
Deobfuscation	Built-in auto-rename	Yes
Smali debugger	Yes (jadx-gui)	Yes
Format support	APK, DEX, AAB, JAR, and more	APK, DEX, AAB, and more

Jadx covers the core decompilation workflow at no cost and is the default starting point for most Android reverse engineering work. Its Apache-2.0 license allows commercial use without restriction, which matters for professional security teams and independent consultants.

JEB Decompiler is a paid commercial tool. Its licensing cost makes it harder to justify for individual researchers, CTF competitors, or small security teams. For most standard Android analysis tasks, jadx's output is sufficient to understand app logic, identify vulnerabilities, and extract sensitive data.

JEB is worth evaluating when your targets are heavily obfuscated, when decompilation accuracy gaps in jadx are unacceptable for your use case, or when you need commercial-grade support with dedicated engineering behind the tool. Choose jadx for standard Android reverse engineering without licensing overhead; consider JEB when analysis complexity or support requirements justify the cost.

install · quick start

Quick start#

bash

Install jadx using a package manager; Java 11 or later is required on your system.
```bash
# macOS
brew install jadx

# Arch Linux
sudo pacman -S jadx

# Linux (Flatpak)
flatpak install flathub com.github.skylot.jadx
```

tech stack · detected from GitHub

What it's built on#

Languages: JavaKotlin

frequently asked

FAQ#

Is jadx free to use for commercial security work?

Yes. Jadx is Apache-2.0 licensed, which permits commercial use, modification, and distribution with no restrictions. You can use it in paid security engagements, internal tooling, and consulting work without paying a license fee.

Can jadx decompile 100% of an Android APK?

No. The README explicitly states that jadx cannot decompile 100% of the code in most cases, and errors will occur. Complex control flow, aggressive obfuscation, and certain bytecode patterns produce incomplete or incorrect output. The project wiki has a troubleshooting guide for common decompilation issues.

What Android and Java file formats does jadx support?

Jadx accepts APK, DEX, AAB, APKS, APKM, XAPK, ZIP, JAR, class, AAR, and smali inputs. It also decodes AndroidManifest.xml and binary resource files from resources.arsc, so a single run covers both code and resource inspection.

How do I install jadx?

On macOS, run brew install jadx. On Arch Linux, run sudo pacman -S jadx. On Linux desktops with Flatpak, run flatpak install flathub com.github.skylot.jadx. For other platforms, download the latest release zip from GitHub, unpack it, and run the jadx or jadx-gui binary from the bin directory. Java 11 or later is required.

How does jadx compare to JEB Decompiler?

Jadx is free and open source under Apache-2.0; JEB Decompiler is a commercial tool with paid proprietary licensing. For standard decompilation of non-obfuscated or lightly obfuscated APKs, jadx produces output suitable for most security analysis work. JEB is a paid commercial alternative aimed at enterprise security teams with complex targets or requirements for commercial-grade support. Most independent researchers and small security teams find jadx sufficient for day-to-day work.

also worth a look

Similar open-source tools#

ASC

Alternative toJEB Decompiler

Zero-overhead Android decompiler for mobile security researchers

2,510 GitHub stars
Licence Apache-2.0

REA (Reverse Engineer Anything)

Featured

Alternative toRevEng.AI

AI-powered reverse engineering for binaries, apps, and assemblies.

345,900 GitHub stars
Licence MIT

Unkey

Alternative toKong Konnect

Unified API keys, gateways, and observability for developers.

5,471 GitHub stars
Licence FSL-1.1-ALv2

WebCheck-OSINT

Alternative toShodan

44-check OSINT scanner for DNS, SSL, ports, CVEs, and TLS audits

343 GitHub stars
Licence MIT

Statlite

InSecurity & Monitoring

Self-hosted Spring Boot monitoring, no Prometheus or Grafana needed

177 GitHub stars
Licence MIT

Oxynote

Alternative toNotion

Technical wiki with live metrics, draft reviews, and real-time editing

244 GitHub stars
Licence Apache-2.0

by category

Open source tools in these categories#

461

2,957 GitHub stars
Licence Apache-2.0
#AI Agents

Inbox Zero

Alternative toSuperhuman

AI email assistant that drafts replies and clears your inbox

12,712 GitHub stars
Licence AGPL-3.0
#Email

rakazo

Alternative toGrok Bot

AI teammates you own: your keys, your model, your machine.

4,904 GitHub stars
Licence Apache-2.0
#AI Agents

Feature your project

The projects we add and every new guide. Free, unsubscribe any time.

Find open source alternatives to paid software

Jadx vs JEB Decompiler

Jadx and JEB Decompiler both target Android reverse engineering. Jadx is open source and free under the Apache-2.0 license; JEB is a commercial product with paid proprietary licensing.

Feature	Jadx	JEB Decompiler
License	Apache-2.0	Proprietary (commercial)
Cost	Free	Paid
Runs locally	Yes	Yes
GUI included	Yes (jadx-gui)	Yes
CLI	Yes	Yes
Deobfuscation	Built-in auto-rename	Yes
Smali debugger	Yes (jadx-gui)	Yes
Format support	APK, DEX, AAB, JAR, and more	APK, DEX, AAB, and more

Who Jadx is for#

Security researchers auditing Android apps

Skip if:

Penetration testers doing mobile app assessments

Skip if:

CTF competitors analyzing DEX payloads

Developers recovering code from compiled APKs

Skip if:

The problem it solves#

How it solves it#

APK, DEX, and AAB Decompilation

jadx-gui: Interactive Code Viewer

Built-in Deobfuscator

Smali Debugger

AndroidManifest.xml and Resource Decoding

Plugin System

Strengths and trade-offs#

Strengths

Trade-offs

Jadx vs alternatives#

Jadx vs JEB Decompiler

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Developer Tools

Security & Monitoring

Find open source alternatives to paid software

Who Jadx is for#

Security researchers auditing Android apps

Skip if:

Penetration testers doing mobile app assessments

Skip if:

CTF competitors analyzing DEX payloads

Developers recovering code from compiled APKs

Skip if:

The problem it solves#

How it solves it#

APK, DEX, and AAB Decompilation

jadx-gui: Interactive Code Viewer

Built-in Deobfuscator

Smali Debugger

AndroidManifest.xml and Resource Decoding

Plugin System

Strengths and trade-offs#

Strengths

Trade-offs

Jadx vs alternatives#

Jadx vs JEB Decompiler

Quick start#

What it's built on#

FAQ#

Similar open-source tools#

Open source tools in these categories#

Developer Tools

Security & Monitoring

Find open source alternatives to paid software