Tool

Association File Linter

Paste an assetlinks.json or apple-app-site-association file to check its JSON and its shape against the fields Google and Apple document: relations, package names and fingerprints for Android; app identifiers and components for Apple. It cannot see your server, your keys or a device.

By Ryan FletcherPublished October 28, 2026Updated October 28, 20261 min read

In short

Finds JSON syntax errors and the line they occur on, where the browser reports it.
Android: relation, android_app target, package name, upper-case SHA-256 fingerprints, dynamic rule keys.
Apple: applinks details, Team ID prefixed app identifiers, component keys, mixed formats.
Always reminds you what it cannot check: hosting, redirects, signing keys and caches.

Check a file's shape

Android checks

The root is an array with at least one statement.
A statement grants delegate_permission/common.handle_all_urls.
The target uses the android_app namespace, a package name such as com.example.app and at least one fingerprint of 32 colon-separated hex pairs, in upper case.
Dynamic rules, if present, use only the documented keys (/, ?, #, exclude) with the right types, once per app. Android discards all dynamic rules if any field is malformed or empty.

The fields are explained in the assetlinks.json guide.

Apple checks

The root is an object; applinks.details is an array.
Each app identifier has the form <Team ID>.<bundle identifier>, for example ABCDE12345.com.example.app.
Components use documented keys (/, ?, #, exclude, comment, caseSensitive, percentEncoded) with the right types.
The file does not mix the appIDs and components format with the older appID and paths format.

The format is explained in the Apple App Site Association (AASA) guide, and the two files are compared in the side-by-side note.

Questions

Does a clean result mean verification will succeed?

No. The file also has to be served correctly, list the right signing fingerprints and match the app's manifest or entitlements. The taxonomy of broken app links lists what else can fail.

Why does the linter warn about lower-case fingerprints?

Android's troubleshooting guide lists a lower-case signature in assetlinks.json as a cause of failure and says the signature should be in upper case.

Sources

Android Developers, Configure website associations and dynamic rules, last updated October 23, 2026.
Android Developers, Troubleshoot App Links, last updated October 23, 2026.
Apple Developer, Supporting associated domains, no date shown.
Apple Developer, applinks (Bundle Resources), no date shown.
Apple Developer, TN3155: Debugging universal links, latest revision May 15, 2025.

How we choose and date sources: data sources.