Answer
Yes. An APK is a ZIP archive, and the HTML, CSS and JavaScript of a WebView app are stored in it as files. Anyone with the APK can unzip it and read them. Minifying and obfuscating JavaScript make the code harder to read but not secret, so passwords, API keys and private data must stay on a server.
What you can do
- Minify (Terser, esbuild) — smaller and less readable.
- Obfuscate (javascript-obfuscator) — much harder to follow, slower to run; not real protection.
- Move logic to a server — the only way to keep something secret is to never ship it.
- Copyright notice — reading code is easy; reusing it without permission is still infringement.
Never put in your HTML
API secret keys, database passwords, admin credentials, private customer data, paid-content unlock codes.
Frequently asked questions
Is a native app's code hidden?
Not completely either — it can be decompiled — but compiled code is much harder to read than plain HTML and JavaScript.