Convert APK to CSV

An application inventory system or spreadsheet may require package names, versions, SDK levels, or permissions in CSV form. Because an APK is an Android package rather than a table, the practical operation is to extract selected metadata or an embedded data file, not convert the entire package.

What the APK format is

An APK is the installable package used by Android. Android Studio, Gradle, and other Android build systems create APK files, which developers, app vendors, enterprise administrators, testers, and users distribute through Google Play, managed deployment systems, or direct downloads.

An APK is a ZIP-based container that commonly includes AndroidManifest.xml, compiled Dalvik or ART bytecode in classes.dex, resources, native libraries, assets, and signing data. It can contain an embedded CSV or another document, but an application's runtime database and user-created data normally reside separately on the Android device.

What the CSV format is

CSV stores records as delimited text rows and columns. Microsoft Excel, LibreOffice Calc, Google Sheets, databases, scripts, and inventory systems can import it without requiring the original application.

CSV works for fields such as package name, version code, version name, application label, minimum SDK, target SDK, permissions, file paths, or one record per APK. It cannot preserve executable code, signatures, images, resources, or the complete directory structure as a useful single table.

Extract APK metadata with Android tools

1. Install Android SDK Build-Tools and locate aapt2. Add its versioned Build-Tools directory to the command path, or call the executable by its full path.
2. Inspect the package with aapt2 dump badging app.apk. Redirect the result to badging.txt if you also need a human-readable report.
3. Extract selected fields into one CSV row with a script such as the following, saved as apk_metadata_csv.py:

import csv
import re
import subprocess
import sys

apk = sys.argv[1]
outfile = sys.argv[2]
text = subprocess.check_output(
    ['aapt2', 'dump', 'badging', apk],
    text=True,
    errors='replace'
)

def find(pattern):
    match = re.search(pattern, text)
    return match.group(1) if match else ''

row = {
    'file': apk,
    'package': find(r"package: name='([^']+)"),
    'version_code': find(r"versionCode='([^']*)"),
    'version_name': find(r"versionName='([^']*)"),
    'label': find(r"application-label:'([^']*)"),
    'min_sdk': find(r"sdkVersion:'([^']*)"),
    'target_sdk': find(r"targetSdkVersion:'([^']*)")
}

with open(outfile, 'w', newline='', encoding='utf-8') as file:
    writer = csv.DictWriter(file, fieldnames=row)
    writer.writeheader()
    writer.writerow(row)

Run it with python apk_metadata_csv.py app.apk app.csv. The result has one header row and one metadata row. Run the script once per APK and append the data rows to a file with the same header when building an inventory.

Extract an embedded CSV

Open the APK with 7-Zip or another ZIP utility and inspect assets, res/raw, and other directories. Use 7-Zip → Extract to… and open any existing .csv file directly; no format conversion is needed. A file with a different structure, such as JSON or SQLite, requires its own parser or export procedure.

Use Apktool when you need decoded resources or a readable manifest, and JADX when you need Java-like views of decompiled application code. Neither tool converts the complete APK into meaningful CSV records. Rebuilding an APK after decoding can invalidate its original signature unless it is signed again.

Online and desktop options

There is no reputable general-purpose online service that can infer a meaningful CSV schema from every APK. Desktop tools such as Android SDK Build-Tools, 7-Zip, Apktool, and JADX avoid uploading proprietary code, certificates, or embedded data. An online APK analyzer may be useful for a non-sensitive sample if it explicitly documents metadata or report export, but check whether its output is actually CSV and review its retention policy before uploading.

Quality and compatibility limits

Metadata can be incomplete when values are obfuscated, localized, encoded in binary resources, or unavailable from the selected tool. A split application may consist of a base APK plus configuration and feature APKs; inspect the complete set when the inventory must represent the installed app.

When importing the result, select UTF-8 and use a comma delimiter unless the receiving system specifies another separator. Treat package names and version codes as text so spreadsheet software does not reformat them. Quote fields containing commas, quotation marks, or line breaks; Python's CSV writer handles that quoting automatically.

Extracting data does not convert or alter the original APK. Do not upload private, signed, proprietary, or malware-sample packages to an online service, because analysis may expose application code, embedded secrets, user data, or signing information.