Manifest Permission Explainer

The four kinds of Android permission

Developers often treat permissions as one list. Android does not — how a permission is granted matters as much as what it does.

Normal

Granted automatically at install. The user is never asked and cannot revoke it. INTERNET is the obvious example.

Runtime (dangerous)

The user sees a dialog and can say no, or revoke it later in Settings. Your app must handle refusal gracefully — not crash, and not nag.

Special access

There is no dialog at all. The user has to walk into a Settings screen and enable it manually. SYSTEM_ALERT_WINDOW and MANAGE_EXTERNAL_STORAGE work this way, and the extra friction means most users never complete it.

Service binding

Declared by a service in your manifest and switched on by the user in Settings. Accessibility and notification listener services live here, and both attract heavy scrutiny.

The Play Console problem

A permission can be perfectly legal in Android and still stop your release. Google Play restricts a set of permissions to apps whose core function requires them, and asks for a written declaration — sometimes a demonstration video — before approving.

The ones that catch people out most often are the SMS and Call Log group, MANAGE_EXTERNAL_STORAGE, QUERY_ALL_PACKAGES, ACCESS_BACKGROUND_LOCATION and REQUEST_INSTALL_PACKAGES. In many cases there is an unrestricted alternative that does the same job: the SMS Retriever API instead of READ_SMS, a <queries> element instead of QUERY_ALL_PACKAGES, the photo picker instead of broad storage access.

Permissions you probably no longer need

Manifests accumulate. WRITE_EXTERNAL_STORAGE has done nothing since Android 10. READ_EXTERNAL_STORAGE has done nothing since Android 13. READ_PHONE_STATE stopped returning device identifiers in Android 10 but is still requested out of habit, and it costs you a runtime prompt for nothing. This tool flags those.

Nothing is uploaded

Your manifest is parsed by JavaScript in your own browser. It is not sent anywhere, and this site has no server to send it to.

Questions

Is my manifest uploaded?

No. Parsing happens locally in your browser. You can disconnect from the internet after the page loads and it still works.

Does it catch custom permissions?

It lists them and marks them as not recognised. Permissions declared by your own app or by a library will not be in the reference, which is expected rather than a problem.

Is this the complete list of Android permissions?

No. It covers the permissions that commonly appear in real manifests and the ones that cause release problems. Anything unrecognised is shown rather than silently dropped.

Is the Play guidance authoritative?

It reflects Google's published policy, but policy changes and enforcement varies. Treat it as a warning to check, not as a final ruling. Play Console is the only place that can tell you definitively.