What the assetlinks.json Validator does
This validator checks a Digital Asset Links file - the assetlinks.json that proves to Android that your website and your app belong together - so that App Links verify. It checks the JSON shape, relations, package names and SHA-256 certificate fingerprints, confirms your app and signing key are listed, and, if you give it a domain, fetches the file and checks how it is served: status, content type and redirects.
When verification fails, Android does not tell the user; links simply open in the browser. Almost every failure traces back to this file or to how the server delivers it, which is why both are checked here.
How to use it
- Enter a domain and choose Fetch to read https://domain/.well-known/assetlinks.json through a2z.tools' public fetcher, or paste the file's contents.
- Optionally enter your application ID and the SHA-256 fingerprint of your app signing certificate. The fingerprint can be pasted with or without colons, in any case.
- Choose Validate. Problems are listed first, then the statements the file contains.
- Fix the file or the server, fetch again, and download the report if you need to share it.
Reading the results
A problem means Android's verifier will reject the file or not find your app in it: invalid JSON, an object instead of an array, a malformed fingerprint, the wrong package, or the file served with a redirect or the wrong content type.
The expected-fingerprint check compares your fingerprint with the file after normalising both, and passes only if it appears in a statement for your package with the handle_all_urls relation - the one App Links need.
Hosting results come from one fetch from a2z.tools' server. A pass means the file was reachable from the public internet then; it does not prove every region or CDN edge serves the same thing.
Worked example: a lower-case fingerprint and a missing array
The "common mistakes" example is a statement for com.example.shop written as a bare JSON object, with its fingerprint in lower case.
The validator reports two problems. The top level must be an array of statements, so the object needs wrapping in [ ]. And once wrapped, the fingerprint 14:6d:e9:... is refused, because the Digital Asset Links format writes SHA-256 fingerprints as 32 upper-case hexadecimal pairs separated by colons, as keytool prints them.
The valid example shows the fixed file. Its expected fingerprint was entered as 64 lower-case characters without colons; the validator normalises that to 14:6D:E9:... and confirms it is listed for com.example.shop with handle_all_urls.
Limitations: what the result does not prove
- It checks the file and one fetch of it. It cannot see which key actually signs the app on a device - compare with Play Console, App integrity, or keytool output.
- Android verifies every host in an autoVerify intent filter. If one host's file is missing or wrong, older Android versions fail the whole app; check each host, not just the main domain.
- The fetcher reads only text types. If your server sends another content type, the page reports that as a problem and you can paste the file to check its contents.
Privacy: where your data goes
The analysis runs in your browser. If you choose to load a public URL instead of pasting, a2z.tools fetches that address read-only and returns the text to your tab; private and internal addresses are refused and nothing is stored. Session recording and tag-manager scripts are switched off on this page.
Standards and sources
- Android Developers - Verify Android App Links - checked 19 Sep 2026
- Google Digital Asset Links - Getting started
- Google Digital Asset Links - Statement list syntax
Frequently asked questions
Where must assetlinks.json be hosted?
At https://your-domain/.well-known/assetlinks.json, over HTTPS, returning HTTP 200 with the Content-Type application/json and no redirects. For a wildcard host such as *.example.com, it goes on the root domain, example.com.
Which fingerprint do I put in assetlinks.json?
The SHA-256 fingerprint of the certificate that signs the installed app. With Play App Signing that is the app signing key in Play Console under App integrity, not your upload key. You can list several fingerprints, for example release and debug.
Why does Android say my App Links are not verified?
Common causes are a missing or redirected file, the wrong content type, a fingerprint for the upload key instead of the signing key, a typo in the package name, or one of several hosts in the intent filter failing. Run adb shell pm get-app-links with your package to see per-domain states.
Does the fingerprint have to be upper case?
The format documented by Google and produced by keytool is upper-case hexadecimal pairs separated by colons. Other forms are not what the specification shows, so the validator treats them as a problem and suggests the correct form.
Can one assetlinks.json list several apps?
Yes. The file is an array of statements, and each statement names one app and its fingerprints. Add a statement per app, such as a main app and a separate tablet or beta build, all with the handle_all_urls relation.
Is my file sent anywhere when I paste it?
No. Pasted JSON is checked in your browser. Only the Fetch button makes a request, and it asks a2z.tools' server to read the public file from the domain you typed.
Last reviewed by the A2Z.Tools team against the sources listed above.
