Loading page
About this tool
Review an Android manifest or permission list locally and understand sensitive access patterns often relevant to abusive loan-app behavior.
The Loan App Permission Risk Auditor reads a pasted AndroidManifest.xml or plain permission list and classifies every declared permission against a focused checklist of 28 sensitive Android permissions grouped into nine areas — contacts, SMS, call logs, files and media, accessibility, location, package installation, screen overlay and device admin. It then runs eight combination rules that flag pairings such as contacts plus SMS, or accessibility plus overlay, and returns one of four review levels: high-attention, elevated, review recommended, or no focused signal. It is built for borrowers, journalists and consumer-protection volunteers who want to understand what a lending app is asking for, and the text never leaves the browser.
Open Loan App Permission Risk Auditor on AltFTool — it loads instantly in your browser.
Enter the values you already know.
Fine-tune the options to match your scenario.
Read the result and use it in your planning or reporting.
Eight paired-capability checks catch risky overlaps like background location plus contacts that a flat permission list hides.
Every flagged group returns the specific Android Settings path to revoke it, including special-access screens for overlay and install-unknown-apps.
It auto-detects the input kind, strips the android.permission. prefix, counts duplicates, and still reports unrecognised permissions separately.
It checks 28 named Android permissions across nine sensitive groups: contacts, SMS and MMS, call logs and phone state, files and media, accessibility service, location including background location, package installation, display-over-other-apps, and device administrator. Anything else you paste is listed as an unclassified declared permission rather than silently dropped.
No. A manifest declaration is only a request; runtime permissions still require the user to grant them, and accessibility services, overlays and device admin each need a separate opt-in in Android Settings. The audit tells you what could be asked for, not what was granted or used.
It returns high-attention review if any high-level combination rule fires or three or more high-attention groups appear; elevated review if there is at least one high-attention group or a medium combination; review recommended if any checklist permission appears at all; and no focused signal otherwise.
No — it is an informational checklist, not a malware scan, a legal determination or evidence of wrongdoing. If you are facing harassment, coercion or unauthorised debits, preserve screenshots and messages and contact your regional consumer-protection or cybercrime authority.