# mitmproxy/android-unpinner

Remove Certificate Pinning from APKs

Repository: https://github.com/mitmproxy/android-unpinner
Canonical: https://ross.abutalabs.com/products/android-unpinner
Language: Python
License Family: other
Topics: android, reverse-engineering, mitm, mitmproxy, apk, certificate-pinning, frida, jdwp
Last push: 2025-10-30T13:00:05+00:00

## Health v2 (maintenance only)
Score: 54/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 49, release rhythm 35, longevity 100
- inputs: {"age_days": 1641, "days_push": 307, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1032, forks 82 (observed 2026-08-28T04:03:18.270633+00:00)

## What it is
A Python CLI tool that removes certificate pinning from Android APKs so traffic can be intercepted with mitmproxy, without requiring a rooted device. It patches only AndroidManifest.xml to mark the app debuggable, then injects the Frida Gadget via a custom JDWP implementation over ADB.

## Use cases
- remove certificate pinning from an apk
- intercept https traffic from an android app without root
- patch an apk to be debuggable and inject frida gadget
- bypass ssl pinning for mobile app testing
- unpin xapk split apks and reinstall via adb
- pull apks from a connected device and unpin them

## When to choose
- you need to MITM an Android app on a non-rooted device
- you want minimal APK modification (classes.dex untouched)
- you want a one-command tool with bundled adb/apksigner dependencies
- you need to handle XAPK split APKs

## When to avoid
- you need an interactive runtime analysis shell (use objection)
- you cannot run a desktop machine connected during app launch
- you need to hide from root detection on a rooted setup
- you need a general-purpose Frida scripting toolkit

## Facets
- artifact type: cli-tool
- maturity: active
- function: reverse-engineering, security, cli
- domain: security, reverse-engineering, android-tools, penetration-testing
- platform: windows, cli, python
- tags: android, apk, certificate-pinning, frida, mitm, mobile-security-testing, linux, macos

## Member repositories
- mitmproxy/android-unpinner (main) score 54

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:03:18.270633+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:06:45.509258+00:00, confidence not recorded.
  - readme: https://github.com/mitmproxy/android-unpinner (fetched 2026-08-28T04:03:18.270633+00:00, sha c57621185c69)
- Data as of 2026-08-30T08:39:29.467469+00:00.