Android Asset Links JSON Preflight

What this assetlinks validator can establish

An assetlinks.json file contains statements that connect a website to an Android app. For the supported App Links profile, the root is a nonempty array. Each statement includes a relation list containing delegate_permission/common.handle_all_urls and an Android target with namespace, package_name and sha256_cert_fingerprints.

This preflight tests those field shapes and values. Fingerprints must contain 32 hexadecimal byte pairs separated by colons. Both upper- and lowercase hexadecimal characters are accepted. A string that has the correct shape can still identify the wrong certificate; local parsing cannot establish that it belongs to your released app.

Check a statement before deployment

1. Select Choose file for the JSON you intend to deploy, or paste the full array into the input.
2. For pasted content, select Process files. The example control provides a fictional package and a syntactically shaped test fingerprint.
3. Inspect each package row and reported issue. Correct the source rather than editing only a displayed preview.
4. Download assetlinks-report.json to keep the local findings, then check hosting and device verification separately.

There is no domain input or live-fetch button in this assetlinks validator. Supplying a URL as plain text does not retrieve its file. Export the actual document from your repository or hosting environment first. Processing stays in the browser, which is useful when you want to examine a release configuration without sharing its contents with a remote validation service.

Example: package and signing fingerprint

The example statement uses namespace android_app, package com.example.app and the handle-all-URLs relation. Its fingerprint is the pair AB repeated 32 times with colons between the pairs. That passes the shape check but is deliberately fictional. It cannot associate your app with any site.

A SHA-1 fingerprint with only 20 byte pairs does not satisfy the SHA-256 field. A fingerprint copied without separators also fails this profile. Obtain the actual signing certificate information from your build or distribution setup, then compare every byte. Do not substitute an upload-key fingerprint for the distributed application’s signing certificate merely because both are shown in a console.

File validation versus verified Android links

Successful App Links behavior also depends on your app manifest, the distributed app’s identity, the website’s HTTPS response and device verification state. None of those are tested by a local JSON file check. A document with zero reported findings can still be inaccessible, served from the wrong host, redirected unexpectedly or associated with an app build signed by another key.

Follow the current Android App Links verification documentation after deployment. Device commands and behavior can vary with Android versions; use the official workflow appropriate to your test device rather than treating a local report as a device test.

Common errors and practical next steps

Check for trailing commas and quotation marks changed by a rich-text editor if JSON parsing fails. Keep a nonempty statement array, and spell property names exactly. A human-readable app label is not a package name: use the application ID from the released package. Adding a second fingerprint may be intentional for multiple authorized signing identities, but every entry still needs the correct SHA-256 shape.

This assetlinks validator does not validate dynamic App Links rules, certificate ownership or other Digital Asset Links relation profiles. For the iOS side of a shared deep-link deployment, check the Apple association file with its separate format rules. If you need to share a network trace while investigating hosting, sanitize the HAR file before sending it; that workflow removes sensitive trace details rather than validating app associations.

Common assetlinks validator errors and how to fix them

When the assetlinks validator cannot use a file, it stops with one clear message instead of producing a half-finished download. These are the problems people run into most often, with the fix for each:

• The file is not valid JSON. A trailing comma or comment breaks parsing.
• Expected colon-separated SHA-256 signing certificate fingerprints. Each fingerprint must be 32 hex bytes separated by colons. Short or SHA-1 values are reported.
• Missing handle_all_urls relation. The statement does not grant delegate_permission/common.handle_all_urls.
• Invalid Android target namespace or package name. The target must use namespace android_app and a valid package name.

Privacy: the assetlinks validator runs in your browser

Assetlinks validator processing happens with JavaScript in a background worker on this page. Your file is not uploaded to a FileFix server, and the results you download are created in your browser’s memory. Configuration and network captures can expose tokens, hosts and internal paths, so local checking avoids another copy on someone else’s server. When you finish on a shared computer, clear the selection or close the tab.

For the underlying format rules, see the Google Digital Asset Links. The assetlinks validator follows the subset described on this page rather than every optional feature in those documents.

Sources

• Android App Links verification documentation
• Google Digital Asset Links

Questions about this tool