Appy

Free dev tool

Universal Link Validator

Make sure your links open your app. Paste a domain to check iOS Universal Links and Android App Links, then get a clean pass/fail summary with fix steps you can hand to engineering.

Fix links with Appy Browse tools
Run a validation
Paste a domain or URL and validate your app-opening setup.

How it works

What happens when someone taps your link

Neither platform looks at your domain at the moment of the tap. Both check it when the app is installed, remember the answer and use it when a link is tapped. That is why a broken file can go unnoticed for days, and why a fixed one does not help instantly.

iPhone and iPad

apple-app-site-association

  1. At install

    Reads Associated Domains

    iOS looks at the applinks: entries in the app’s Associated Domains entitlement.

  2. At install

    Fetches through Apple’s CDN

    Apple’s CDN downloads the file from your domain and hands the device its cached copy.

  3. On tap

    Matches the link

    iOS compares the tapped domain and path with the app IDs and paths or components in that file.

  4. Result

    Match: your app opens

    No match or no file: Safari opens the page

Android

assetlinks.json

  1. At install

    Reads intent filters

    Android finds the intent filters marked autoVerify for your domain.

  2. At install

    Fetches assetlinks.json

    It requests the file from /.well-known/ on every declared host. A redirect counts as a failure.

  3. At install

    Checks the signing certificate

    The package name and SHA-256 fingerprint in the file must match the certificate that signed the installed app.

  4. Result

    Verified: your app opens

    Not verified: the browser opens, or a chooser on older Android versions

The validator covers the server side of both chains: whether each file sits where iOS and Android look for it, and whether it says what they need to read.

Checks

What this tool checks

One run makes up to ten requests: both association files on your domain and on its www (or bare) twin, the copy on Apple’s CDN and Google’s Digital Asset Links API. This is what it looks at.

  • Both locations, both hosts

    Looks for apple-app-site-association in /.well-known/ and at the root, and for assetlinks.json in /.well-known/, on your domain and its www twin.

  • HTTPS and a 200

    Reports the HTTP status of every request, plus timeouts and connection errors that stop a file from loading.

  • Redirects

    Follows redirects, shows where each request ended up and flags a final URL on another host or on plain HTTP.

  • HTML where JSON should be

    Catches a login page, an error template or a bot challenge from Cloudflare, Akamai and similar services, and shows the Content-Type header that came back.

  • Valid JSON

    Parses each file and quotes the parser error when it fails, so you know what to fix.

  • applinks and app IDs

    Confirms applinks.details exists and lists every app ID in it. Add your App ID under Advanced to check that yours is there. Signed (PKCS7) files are recognised, not decoded.

  • Relation and package names

    Checks that assetlinks.json is a JSON array with the delegate_permission/common.handle_all_urls relation and lists its package names. Add your package under Advanced to match it.

  • SHA-256 fingerprint

    Paste your signing certificate fingerprint under Advanced and the validator looks for it in the file, with or without colons.

  • Apple’s copy, Google’s view

    Reads the copy Apple’s CDN serves to iPhones and asks Google’s Digital Asset Links API what it finds for your site, so you can compare both with your server.

No file yet, or one that won’t parse?Generate it with the AASA and assetlinks.json generator

What it can’t see

The app side: the Associated Domains entitlement, intent filters, whether a given path matches your paths or components rules, and how a particular in-app browser behaves. Check those on a real device before a launch.

Troubleshooting

Why links still open the browser

Most cases come down to one of these eight. The validator shows the server-side ones; the rest only appear on a real phone.

  1. 01iOS + Android

    The tap happens inside Instagram, Facebook or TikTok

    Works from Notes or Messages, opens a web page from a bio link or an ad.

    Fix

    These apps open links in their own in-app browser, which often keeps the URL instead of handing it to iOS or Android. Test every channel on its own and make sure the link still lands somewhere useful when the app doesn’t open, such as the store page or your website.

    Test on a deviceInstagram and TikTok deep links
  2. 02iOS + Android

    The association file redirects

    The file opens fine in a browser, yet verification fails.

    Fix

    Apple and Android expect a direct 200 at the exact URL. Remove http to https, apex to www and locale redirects on /.well-known/.

    Visible in the validatorUniversal links open Safari?
  3. 03iOS + Android

    Wrong Content-Type

    The file loads, yet the platform ignores it.

    Fix

    Serve both files as application/json. The AASA file has no extension, so many servers default to application/octet-stream or text/plain.

    Visible in the validatorUniversal links open Safari?
  4. 04iOS

    Apple’s CDN still has the old file

    You fixed the file, but iPhones keep opening Safari.

    Fix

    Apple’s CDN serves a cached copy that lags behind your server; the validator shows both. While testing, add ?mode=developer to the entitlement and turn on Associated Domains Development in the device’s developer settings.

    Visible in the validatorComplete guide to universal links
  5. 05Android

    The Play App Signing key is missing

    Your own builds open the app, Play Store installs open the browser.

    Fix

    With Play App Signing, Google signs the app people install. Add the SHA-256 from Play Console, App integrity, App signing key certificate. Keep the upload key too if you ship builds outside Play.

    Visible in the validatorAndroid App Links not verified
  6. 06iOS

    The link points to the page’s own domain

    Buttons on your website open more web pages instead of the app.

    Fix

    iOS keeps people in Safari when they tap a universal link to the domain they are already on. Put app links on a separate subdomain, or use a Smart App Banner on the site.

    Test on a deviceComplete guide to universal links
  7. 07iOS

    The user once chose Safari

    The link works on your phone but not on a colleague’s.

    Fix

    Tapping the domain in the top-right corner after the app opens tells iOS to prefer Safari for that domain. Long-press the link and choose to open it in the app to switch back.

    Test on a deviceUniversal links open Safari?
  8. 08iOS

    The App ID doesn’t match the build

    Works in the staging build, fails in the release build.

    Fix

    The entry must be your Team ID plus the exact bundle ID of the shipped app, for example ABCDE12345.com.example.app. Enter it under Advanced and the validator checks it.

    Visible in the validatorComplete guide to universal links

Skip the plumbing

Make links that just work

An Appy link looks at every tap and sends it to the right place: the App Store on an iPhone, Google Play on Android, your website on a laptop. Add deep links on Pro and people who already have the app land straight in it.

  • Free plan
  • No credit card
  • Unlimited clicks on every plan
  • Links keep working if you cancel
Create a free linkCompare plans

On Enterprise, your app gets its own link domain, and Appy hosts apple-app-site-association and assetlinks.json on it for you. How the SDK works

Frequently asked questions

What is an apple-app-site-association (AASA) file?

A JSON file on your domain that tells iOS which apps may open which links. It lives at https://your-domain/.well-known/apple-app-site-association, has no .json extension and lists your app IDs (Team ID plus bundle ID) with the paths or components they handle.

Where do the association files have to live?

iOS reads /.well-known/apple-app-site-association and Android reads /.well-known/assetlinks.json, on every host you use in links. Both must load over HTTPS with a direct 200, no redirects and the application/json content type.

Why do universal links open Safari instead of my app?

Either verification failed (a missing, redirected or invalid file, or an app ID that does not match the build), or iOS chose Safari on purpose: the tap came from an in-app browser or from a page on the same domain, or the user once picked Safari. Run the validator first; if it passes, test those cases on a device.

Why do links in my marketing emails open the browser instead of the app?

Email tools wrap each link in a click-tracking URL on their own domain. iOS and Android decide on that first domain only, and a redirect after it can’t open an app. Switch the validator to Link from an email and paste a link from a test email: it follows the redirects, names the email tool and shows what the tracking domain needs.

How do I check my assetlinks.json?

Enter your domain above and open Advanced to add your package name and SHA-256 fingerprint. On a test phone, adb shell pm get-app-links com.example.app shows whether Android marked each domain as verified.

Why does Android say app links verification failed?

Most often the fingerprint in assetlinks.json belongs to your upload key, while Play Store installs are signed with Google’s app signing key. Redirects, a wrong content type and bot protection on /.well-known/ come next. After fixing the file, run adb shell pm verify-app-links --re-verify com.example.app.

How long does Apple take to pick up a changed AASA file?

There is no instant refresh. Devices get the file from Apple’s CDN, which serves a cached copy, so a fix on your server takes a while to arrive. The validator shows the CDN copy next to yours. During development, ?mode=developer on the entitlement lets a device fetch straight from your server.

Do universal links work inside Instagram, Facebook or TikTok?

Often not. These apps open links in their own in-app browser, and whether a tap reaches your app depends on the app and the placement. Test each channel, and make sure your website or store listing works as a destination on its own.

Does the validator check my app, entitlements or paths?

It reads what your server, Apple’s CDN and Google’s Digital Asset Links API return. For a link from an email it also checks whether the rules in the AASA file cover that link. The app side, meaning the Associated Domains entitlement and intent filters, needs a test on a real device.

What is the difference between deep links and universal links?

A deep link is any link that opens a specific screen in an app. Universal Links on iOS and App Links on Android are the verified kind: ordinary HTTPS URLs that open the app when it is installed and a web page when it is not.

Do I need an account, and can I share the result?

No account is needed and the validator is free. Every run gets its own URL that you can copy and send to your developer. Those result pages are kept out of search engines.