An APK is a ZIP archive containing AndroidManifest.xml (the app's identity and permissions), classes.dex (compiled code), resources.arsc and res/ (compiled resources and icons), assets/ (raw files — where an HTML app's web files live), optional lib/ native libraries and signing data. Android verifies the signature before installing it.
The layout
myapp.apk
├── AndroidManifest.xml binary XML: package name, version, permissions, activities
├── classes.dex the app shell's compiled Kotlin/Java (DEX bytecode)
├── classes2.dex … more code when one DEX file is not enough
├── resources.arsc compiled resource table (strings, colours, styles)
├── res/ icons at each density, layouts, drawables
├── assets/ raw files, untouched by the build — your HTML lives here
├── lib/arm64-v8a/ … native .so libraries (if any)
├── kotlin/, META-INF/ metadata; v1 signature files for old Android versions
└── (APK Signing Block) v2/v3 signatures — not a file, stored inside the ZIP structureWhat each part does
| Part | Contains | Why it matters for an HTML app |
|---|---|---|
AndroidManifest.xml | Package name, version code and name, min/target SDK, permissions, launcher activity | Package name + version decide whether an update installs; permissions are what users and Play see |
classes.dex | Compiled app code | The WebView shell — identical across apps from the same builder |
res/ | Launcher icons (mdpi → xxxhdpi), adaptive icon layers, splash drawables | Your icon, resized for every screen density |
resources.arsc | Lookup table for all resources | Holds your app name and colours |
assets/ | Arbitrary files read at runtime | Your index.html, CSS, JS, images — served to the WebView |
lib/ | Native code per CPU architecture | Usually absent or small in WebView apps |
Signing block / META-INF | Certificates and digests | Proves who built it; must match for updates |
Where your HTML lives and how it loads
In apps built with HTML2APK, your files sit under assets/ and the WebView requests them from https://appassets.androidplatform.net/web/. Android's WebViewAssetLoader intercepts those requests and answers from the APK. Because the origin is https, modern web features (modules, fetch of local JSON, storage) behave as on a real website — unlike the old file:// approach, which blocks many of them.
Look inside yourself
unzip -l myapp.apk # list everything
unzip myapp.apk 'assets/*' -d out # extract web files
# with the Android SDK build tools:
aapt2 dump badging myapp.apk # package, version, SDKs, permissions
apksigner verify --print-certs myapp.apkAPK vs AAB in one line
An AAB (Android App Bundle) holds the same parts unsplit; Google Play turns it into optimised APKs per device. You upload AABs to Play and install APKs on phones.
Frequently asked questions
Is an APK just a ZIP file?
Structurally yes — it uses the ZIP format, so any unzip tool can open it. It also carries a signing block that Android checks; editing files inside breaks the signature.
Can I edit the HTML inside an APK?
You can extract it, but changing files invalidates the signature, so the APK will not install until re-signed — and updates require your original key. Rebuild instead.