Good news!

I have been successfully able to register App Manager and Captive Portal Controller in the Android developer verification console. From tomorrow, users from countries where App Manager had previously been restricted due to regulatory issues (e.g., Singapore, Thailand, Turkey) should be able to install App Manager without bypassing Google Play Protect. However, I didn't receive any updates from Google regarding how all these are going to play out with Google Play Integrity API. If you encounter any issues with you banking apps because of App Manager, please contact me with necessary documentation (Android version, affected app info, screenshots, etc.) so that I can discuss this with Google Play's support team. Note that due to the verification requirements, only the "official" version of App Manager has been registered. You can download the official version from the Telegram channel, GitHub releases, Matrix group, or IzzyOnDroid repository on F-Droid. There is another F-Droid version located in the F-Droid official repository which is signed by F-Droid and couldn't be registered at this moment.

You can find live updates here: https://infosec.exchange/@muntashir/116372607911622394

📣 May'26 Updates

It's been a while since I posted the last update (which was in September last year). As some of you are aware, I've been very busy with a lot of things and could hardly allocate time to my open source projects. However, I always try to respond to the emails and the issues raised on the GitHub issue tracker.

There's a good news though. My course work for PhD will be completed on the first week of June, which means I no longer have to worry about attending classes and exams, etc., only research. This also means that I can finally allocate some time to my open source projects too. If you're translating App Manager, you may know that the translations have been locked for a while. This is because I am currently reviewing over 200+ translation contributions made in the last few months by over 50 translators. Once I am finished merging all the translations, I shall unlock the translations.

The release process involves a few more steps though. First, I need to go through all the changes made (which is over one thousand). Then, I will update the documentation as well as write the changelog. Finally, I will do a final check to see if I have addressed all the issues that I have added to the milestone, and also if there are any security disclosures to be made (unfortunately, I cannot pay anybody for reporting security vulnerabilities though). Then the release will be made. The earliest possible date, as I have mentioned in the Matrix group a few months ago, is June (quite possibly in the third week).

I am not going to work on any major features until the end of the year. So, the focus this year will be on improving the existing features, especially the permission management (like I mentioned in a previous update).

As I mentioned before, the next release (v4.1.x) will be the last release to support Android Lollipop (5.0 and 5.1). After that the versions will diverge, and Android Lollipop users will only receive yearly updates. Google has also signaled that they are dropping support for Android Marshmallow (6.0) from the core libraries. If they do this by this year, it may extend to 6.0 too.

Translators.

If you've started translating App Manager as a new translator on or after 17 April 2025, make sure to request explicit permission as stated in the Weblate banner for the project. If you do not request permission, your translations will not be considered regardless of their quality. If you fail to do this by June 14, your past translations will be discarded. Note that asking for permissions does not ensure that your translations will be accepted. It will go through additional scrutiny to ensure that they adhere to our policies. You only need to request permissions once. If at any time we discover issues with your translations (such as machine or AI generated translations), we will take actions against you based on the type of violation.

🎉 6 years of App Manager 🎉

Today marks the sixth anniversary of App Manager. Over the years, I have made significant effort to develop an app that offers some level of control over the digital life in the Android ecosystem.

As of today, I wrote almost 250k lines of code (LOC) with over one million addition and removal in the version control system via 3,650 commits (that's 1.6 commit/day or 11.7 commits/week on average). I have closed almost 1,900 issues and handled over 2,000 private emails. We have over 200 translators translating App Manager in 39 languages.

My efforts has largely been a success. Since I do not track users, and we do not have exact figures from F-Droid, I can only give you GitHub download statistics. From GitHub alone, App Manager has been downloaded over 681,170 times (the latest version alone was downloaded 225,321 times. It also reports over 13k biweekly unique active visitors and over 28k biweekly user engagement. This easily makes it one of the most engaging and active personal open source projects ever developed (which is also completely absent from the mainstream app stores).

I stopped the fundraising campaign in 2024, almost two years ago due to personal reasons. In 2021-24, we hold four fundraising campaign each spanning three months and were able to secure almost $5,000, which was largely a success considering the amount of users at the time.

App Manager project is not just an app, rather it is a front-end. It relies on at least five other projects for various features, such as Android Debloat List, Android Libraries, LibADB. Some of the projects have also helped other people in the long run. LibADB, in particular, has made adaptation of ADB-based features mainstream among the developers who build utility software alongside Shizuku (which is still non-free and as such many FLOSS lovers still ignore).

App Manager is also one of the first material designed utility software on Android. In fact, one motivation for developing App Manager was the lack of well-designed software. Back then, there used to be a lot of utility software on F-Droid (most of them are now in F-Droid Archive), but none of them had modern design, because those applications were developed at a time when many developers actively rejected the Lollipop-era design and stuck with the pre-Lollipop design. Another issue was that the tools largely offered just one particular feature. So, we had to install several applications to achieve something that could've been just a single standalone tool. This was the second motivation.

App Manager is developed for my personal use. If you are a software engineer or work in a tech company, you know how difficult it is to come up with a good design. This is partly because most of the people involved in the production never really use the product. So, they fail to think from the perspective of the user. App Manager is different. It's developed for my personal use, and I use various features several times everyday. So, I have a good understanding of the issues and how to solve them from an user's perspective. This is what made it so powerful. But be aware that App Manager is a very sophisticated and advanced utility software. It takes a lot of effort to keep it scalable, and unless you are a tech savy individual, you will probably never be able to appreciate its true depth. Although I wrote a 85 page documentation for App Manager (which is also very rare for a tool like this), it is very much incomplete.

What lies ahead? The future, as I see it, is very much uncertain. We are in a situation where things can go really bad at any moment. We can finally see a mutual agreement among the leaders of the world regarding mass surveillance (whatever they say out loud regarding privacy and security are just a sham), and I do not see anybody doing anything against this alliance. As Saruman put it, they “are to remove only those who oppose” them. But as Captain Nemo has said, “There is hope for the future. When the world is ready for a new and better life, all this will someday come to pass, in God's good time.”

App Manager v4.1.0

App Manager v4.1.0 comes with massive performance boosts, newly added ADB backup support, UI enhancements, and various other improvements. Visit Settings > About > Version/Changelog for details.

ADB data backup
App Manager now offers full support for ADB backups. A new "ADB data" backup option has been added which supersedes standard internal/external data backups. It creates package-specific .ab files safely encrypted by App Manager without requiring manual ADB backup passwords. Additionally, KeyStore backups are now made optional for Android 12 onwards since KeyStore can no longer be backed up.

Password prompt
When ADB backup is triggered by App Manager, the Android system may ask you to enter a password. You must leave the password field empty and click "OK" to proceed.

Introducing filter-based profiles
A filter-based profile makes it easy to apply the configurations to the dynamically filtered applications at the time of running the profile. Besides the default "and" based filtering, custom expressions can also be used.

Custom expressions
For each profile, each filter item has an unique ID which can be used to refer the filter items in the custom expression field in the "Filters" dialog. Supported operators are & (and), | (or), and parenthesis.

Barchart in App Usage
The App Usage page now displays a visual bar chart for screen time directly in the details dialog. Next and previous buttons have been added to easily browse usage statistics across different days and weeks. Time interval handling has also been simplified by replacing "Today" with "Daily" and removing "Yesterday".

Known limitation: App Manager retrieves usage history from the system. Therefore, the length of the usage history varies across devices and is much less than a typical digital wellbeing application which maintains its own database.

Expanded installer options
Users now have greater control over per-session installer options. Added support for configuring system-level options such as "Request update ownership", "Default package source", and "Set package origin/URI". In addition, there is a new option to temporarily disable APK verification during installation.

Massive performance improvements
The performance of the tracker and library scanner has been significantly improved. By adopting the native (C++) implementation of the Aho-Corasick algorithm, library scanning now yields up to 1000x speedups via parallel processing. Furthermore, a 200 ms debouncer has been introduced for realtime searching and filtering, greatly improving overall performance and reducing power consumption. On the main page, most of the filter implementations have been replaced with Finder-based filters. This change brings semi-realtime updates instead of relying heavily on the cache (especially for force-stop and freeze operations).

UI and Accessibility improvements
The app has adopted Material 3 (M3) style preferences across the board. Accessibility has been vastly improved in various places, including the Running Apps page, Log Viewer, File Manager, Debloater, multi-selection panels, and general Action content descriptions. Support has also been added to change the app language directly from Android Settings in Android 13 onwards.

Others
- Fixed a low severity privilege escalation vulnerability in ADB mode (thanks to 签到型CTFer et al).
- Added option to view, generate, and verify file checksums from file properties in the File Manager.
- Allow managing certain permissions (such as battery optimization and network policy) directly in no-root mode by redirecting to the native system settings.
- Added "Frozen apps" and "Unfrozen apps" filters in the Main and Debloater pages.
- Added dual pane support for "Language" and "About the device" in the Settings page.
- Display "running" tag for apps running without any active services.

Full Changelog: v4.0.5...v4.1.0

I am aware of the Android 17 issues. A hotpatch will be released for Android 17 next week. While most changes from Android 16 to 17 are minor, they have changed a core API which used to let App Manager list the applications themselves. So, basically a minor change causing a major issue.

If you need to access the app details page of an app, you can do so from a supported web browser (Chrome, Brave, etc. should work OOB) by typing the following URL:

app-manager://details?id={{package_name}}

Where {{package_name}} is the actual package name of the app.

App Manager v4.1.1

App Manager v4.1.1 improves permissions, installation, ADB connectivity, and several other parts of the application. Visit Settings > About > Version/Changelog for details.

Revoke Internet Permission
App Manager can now block internet for individual applications utilizing the eBPF rules in root or ADB mode. To block internet for an application, go to the "Uses permissions" tab and click on the toggle button next to android.permission.INTERNET to revoke the permission.

Known Limitation. The eBPF rules are lost after a reboot. App Manager attempts to restore the rules right after a reboot. However, in ADB mode, it might take a while to connect to wireless debugging depending on the availability of a Wi-Fi connection. This might allow applications that start after a reboot to use internet.

Others
- Added support for editing .bat files
- Improved installation reliability and performance
- Improved permission management
- Improved ADB pairing, connections, and mode handling
- Improved settings transitions and startup messages
- Fixed displaying profiles after creating a profile for the first time
- Fixed intercepting browser URLs
- Fixed listing applications on Android 17
- Fixed title ordering in What's New dialog.

Full Changelog: https://github.com/MuntashirAkon/AppManager/compare/v4.1.0...v4.1.1

Why can certain apps having no internet permissions apparently connect to the internet?

They are using a separate provider application. This is true for a lot of applications that use FCM/UnifiedPush protocols to provide notifications (in which case they are either using Google Play Services or a UnifiedPush client). Large software vendors also do something similar: Gemini, for example, doesn't have an internet permission because it does all the API calls via the Google app.

Why are certain apps connecting to the internet despite blocking its internet permission?

Again, they might be using a different provider. This is especially true for push notifications for the exact same reason above. This might actually be a good thing if it is solely used for push notifications as you do not miss out on the notifications even after blocking the internet connection. However, this also means telemetry may also be delivered via another app (e.g., Google Play Services). This is why these UID-backed firewall are often not enough (and as some of you know, I often criticize these firewall technology). An effective firewall would be the one that blocks the tracker URLs altogether: personalDNSfilter is one such tool, which is also very lightweight.

How about other firewall technologies?

The backend I have developed to enable this "permission overlay" can be utilized to add traditional ip-tables style blocking (requires root), net policy-based blocking (supported by Lineage OS), and VPN-based blocking. VPN-based blocking is probably unsuitable for App Manager, and even if it is implemented, we need to take into account my own criticisms about the VPNs: URL based blocking alongside regular app-specific blocking and support for actual VPN configurations or proxies.

Folks.

I was on vacation for the past three and half weeks and spent some time working on a few exciting side features, such as an overhauled audio player, a PDF viewer (which will be turned into a eBook viewer, not reader, eventually), image viewer, and a font viewer. I have spent a significant amount of time understanding how process isolation works on Android and implemented the PDF viewer in a way such that its rendering engine is completely operated in an isolated process, which is somewhat important for security (not extremely important though since we are already covered by other security features such as SSL pinning). There's another feature request that I've been working on for some time: VirusTotal scanning beyond just APK files. I've not yet finished working on it, but hopefully I will be done with the initial implementation before the next release for all of you to preview. After that, we'll figure out what else we can do with VirusTotal feature.

If you have not done already, you can grab your own VirusTotal API key from their website by creating an account. You can also increase your free quota by asking them if you use the feature too much.