Universal Links and App Links validator

Paste your apple-app-site-association or assetlinks.json and see what is wrong before Apple or Google do.

Before you ship

Serve the file over HTTPS at /.well-known/ on every domain the links use, with no redirect.
Send it as application/json (for apple-app-site-association, without a .json extension).
Use the signing certificate of the build people install: Google Play App Signing has its own.
After changing the file, reinstall the app — devices cache it.

How it works

The file is checked in your browser: structure, app IDs, paths and certificate fingerprints.
Browsers cannot fetch another site’s files, so paste the contents rather than a URL.
A valid file is half the job — the checklist below covers the other half.

Why Universal Links open Safari instead of the app

iOS downloads apple-app-site-association through Apple’s CDN when the app is installed, not when a link is tapped. If the file was missing, redirected or malformed at that moment, links open in Safari until the app is reinstalled or the cache refreshes.

The usual causes: the appIDs entry uses the bundle ID without the 10-character Team ID in front; the paths or components do not match the link; the file is served with a redirect or from the wrong host (www versus the bare domain); or the app’s Associated Domains entitlement lacks “applinks:” plus the exact host.

One more: a link tapped on the same domain as the page you are on stays in Safari by design. Test from Notes, Messages or another site.

Why Android App Links open the browser

Android verifies assetlinks.json for every host in an intent filter with android:autoVerify="true". If verification fails for any of them, none of the links open the app automatically.

Most failures are fingerprints: the file lists the debug or upload key, while people install the build signed by Google Play App Signing. Copy the SHA-256 from Play Console, under App integrity, and list every key that signs a build people install.

On Android 12 and later you can check the state with adb shell pm get-app-links followed by your package name, and re-run verification after fixing the file.

Questions people ask

Where must apple-app-site-association be hosted?

At https://your-domain/.well-known/apple-app-site-association, over HTTPS, with no redirect, served as application/json and without a .json extension.

Where must assetlinks.json be hosted?

At https://your-domain/.well-known/assetlinks.json, over HTTPS, with no redirect, served as application/json.

Why can’t I validate by URL?

Browsers do not let a page read files from another site unless that site allows it, and these files usually do not. Open the URL, copy the contents and paste them here.

Which SHA-256 fingerprint do I need?

The certificate that signs the build people install. With Google Play App Signing that is the app signing key shown in Play Console, not your upload key. Add both if you also distribute builds signed with your own key.

I fixed the file but links still open the browser. Why?

Devices cache the result. On iOS reinstall the app; on Android re-run verification or reinstall. Also check the app’s Associated Domains or intent filters name the exact host.

More free tools

One link and QR code for every store

SetLinks sends each visitor to their own store and counts every click. Free to start.

Create a smart link