# FlowDroid > Static data-flow (taint) analysis for Android apps and Java programs, built on Soot and usable as a command-line tool or as Maven libraries. Given an APK, the Android SDK platforms directory and a definition of sources and sinks, it models component lifecycles and callbacks to build a call graph and reports flows from sensitive sources to sinks; the bundled SourcesAndSinks.txt is a starting point for privacy leaks, and StubDroid summaries model library methods. Options cover inter-component flows from a supplied ICC model file, path reconstruction, implicit flows, reflection and timeouts that trade precision and recall for speed, and the analysis is described in the PLDI 2014 paper “FlowDroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for Android apps”. - Type: Tool - Targets: App - Category: Android tools - Relationship: Foundation tool - Sources reviewed: 2026-10-27 - Added to the catalog: 2026-11-03 - Original resource: - Primary source: - Catalog page: - Record JSON: - Chinese version: [简体中文](https://awesomerea.org/zh/resources/flowdroid/index.md) ## Requirements & limits - Latest release at review: v2.15.1, tagged 2026-02-23 and published to Maven Central under de.fraunhofer.sit.sse.flowdroid, including soot-infoflow-cmd-2.15.1-jar-with-dependencies.jar for the command line. GitHub releases since v2.14 attach no files, the last with JARs being v2.13 of 2024-04-02, and the README's Maven example still names 2.12.0. The reviewed develop commit of 2026-09-28 declares 2.16.0-SNAPSHOT. - The command line needs an APK, the Android SDK platforms directory and a sources-and-sinks file, and users supply the apps they analyze. The README says FlowDroid runs on Windows, macOS and Linux and warns that large apps can take very long; options skip static-field or exceptional flows, and additive timeouts for the data-flow, callback-collection and result stages return partial results. - Building needs Maven, a JDK and the current Soot snapshot; the README asks for JDK 11 or above, but the reviewed pom.xml compiles for Java 17 against Soot 4.8.0-SNAPSHOT. The README says the full test suite takes about 30 minutes and also needs JDK 8 with its rt.jar, the ANDROID_JARS variable and the DroidBench submodule, a separate repository of benchmark apps. - The repository commits 25 APKs as test inputs: test apps named after the cases they exercise, such as SourceToSink1.apk and ThreadRunnable.apk, under soot-infoflow-android/testAPKs and soot-infoflow-integration/testAPKs, the deliberately vulnerable InsecureBank.apk, and one hash-named APK whose manifest identifies another developer's app (com.RZStudio.cube). soot-infoflow-android/lib holds JUnit, Hamcrest and protobuf-java JARs. - LGPL-2.1; the README notes that modified versions must be shared under the LGPL. Results depend on the configuration and on the chosen sources and sinks. ## Primary sources 1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11. 12. ## More in Apps - [Enjarify](https://awesomerea.org/resources/enjarify/index.md) · Tool - [MagiskFrida](https://awesomerea.org/resources/magisk-frida/index.md) · Tool - [de4dot](https://awesomerea.org/resources/de4dot/index.md) · Tool - [ClassyShark](https://awesomerea.org/resources/classyshark/index.md) · Tool - [JEB Decompiler](https://awesomerea.org/resources/jeb-decompiler/index.md) · Tool - [Luyten](https://awesomerea.org/resources/luyten/index.md) · Tool ## About this entry The description was reviewed against primary sources. Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.