Universal Links & App Links File Generator
Build and check the files that let your website’s links open your iOS and Android apps.
Free preview.
- Free preview: the first lines of each file (up to 20), and every count of a file check or URL test with its first rows (up to 10).
- Locked until you unlock it: download and copy.
- Unlock: Pro pass, ₹179 for 30 days, a one-time payment that never renews.
Ways to unlock shows how to get the full result.
Printing this result is locked in the free preview.
1. Your website
One per line, without https:// or a path. Each subdomain is separate; *.example.com covers every subdomain and its files are served from example.com.
2. Your apps
3. Which links open the app
The first rule that matches decides. * is any run of characters, ? one character. Query: name=pattern items joined by &; each must be in the URL. A URL that matches no rule opens in the browser.
Your files
Upload each file to the address shown, then check it with the commands (swcutil runs on a Mac, adb with a test device connected; give the device a few minutes after verify-app-links before you read the result). The links open what Apple’s CDN and Google’s Digital Asset Links API read; they open only when you click them.
Send the files as application/json
Nginx
location = /.well-known/apple-app-site-association {
default_type application/json;
}
location = /.well-known/assetlinks.json {
default_type application/json;
} Apache (.htaccess in /.well-known/)
<Files "apple-app-site-association">
ForceType application/json
</Files> A _headers file (Netlify and other hosts that read one)
/.well-known/apple-app-site-association Content-Type: application/json /.well-known/assetlinks.json Content-Type: application/json
Check a file
Paste the file, drop it here or open it. Open your file’s address in a new tab to copy what your server sends.
Report
Test URLs
Tested against the files built above, or the file you check. A path is read on your first domain.
| URL | Apple | Android |
|---|
Locked in the free preview. Opens the ways to unlock this result.
Locked in the free preview. Batch runs unlock with a pass.
Locked in the free preview. Query results unlock with a pass.
About the Universal Links & App Links File Generator
A link to your website opens your app only when the website says so. iOS reads apple-app-site-association (Universal Links, Password AutoFill, Handoff and App Clips) and Android reads assetlinks.json (App Links and sign-in sharing), both from your site’s /.well-known/ folder. Fill in your domains, your apps and which paths should open them, and this page writes both files in the formats Apple and Google document — appIDs and components for Apple, Digital Asset Links statements with optional Android 15 dynamic rules for Google — plus the Associated Domains entries for Xcode and an <intent-filter> for your AndroidManifest.
Already have the files? Paste one to check it: JSON mistakes with their line, wrong Team IDs, bundle IDs and package names, SHA-1 instead of SHA-256 fingerprints, rules that can never match, and formats that should not be mixed. Then test real URLs to see which app opens each one and which rule decides. Everything runs in your browser; nothing is fetched or uploaded.
How to use it
- Under Your website, list each domain the links use, one per line (
example.com,www.example.com). Each subdomain needs its own entry, with the files on its own server;*.example.comcovers all subdomains and is served fromexample.com. - Add your apps: the Team ID and bundle ID for iOS, the package name and the SHA-256 fingerprint of every signing certificate for Android (with Play App Signing, take it from Play Console).
- Under Which links open the app, list rules in order: the first rule that matches decides, and Don’t open keeps a path in the browser. Leave the rule
/*to open every page. - Read the findings, then look at each file. With a pass, or once the files are unlocked, Copy or Download them; the free preview shows their first lines and locks both.
- Upload both files to
https://your-domain/.well-known/and follow the Hosting checklist: HTTPS, no redirects,application/json, and the commands that show what Apple’s CDN and Google’s Digital Asset Links API see.
Examples
Domain: example.com App: ABCDE12345 · com.example.shop Rules: don’t open /account/*, open /products/*, open /cart
{
"applinks": {
"details": [
{
"appIDs": [
"ABCDE12345.com.example.shop"
],
"components": [
{
"/": "/account/*",
"exclude": true
},
{
"/": "/products/*"
},
{
"/": "/cart"
}
]
}
]
}
}https://example.com/products/42 opens the app; /account/orders stays in Safari because the exclude rule comes first; /about matches no rule, so it opens in the browser too.
App: com.example.shop, signed with the certificate of Google’s own example SHA-256: 14:6D:E9:83:C5:73:06:50:D8:EE:B9:95:2F:34:FC:64:16:A0:83:42:E6:1D:BE:A8:8A:04:96:B2:3F:CF:44:E5 Rules: the same three, with Dynamic rules ticked
[
{
"relation": [
"delegate_permission/common.handle_all_urls"
],
"target": {
"namespace": "android_app",
"package_name": "com.example.shop",
"sha256_cert_fingerprints": [
"14:6D:E9:83:C5:73:06:50:D8:EE:B9:95:2F:34:FC:64:16:A0:83:42:E6:1D:BE:A8:8A:04:96:B2:3F:CF:44:E5"
]
},
"relation_extensions": {
"delegate_permission/common.handle_all_urls": {
"dynamic_app_link_components": [
{
"/": "/account/*",
"exclude": true
},
{
"/": "/products/*"
},
{
"/": "/cart"
}
]
}
}
}
]Android 14 and earlier ignore relation_extensions and use the paths of your manifest’s intent filter; Android 15 and later merge these rules with it.
How the rules match a URL
- A rule can test the path (
/products/*), query items (ref=*&lang=en: each named item must be there; other items are ignored) and the fragment. Whatever a rule leaves out matches anything. *matches any run of characters,?exactly one, and?*at least one.- Rules are tried in order and the first match wins; a URL that matches no rule opens in the browser on both platforms.
- On Apple platforms matching is case-sensitive and compares percent-encoded URLs unless you change that;
$(alpha),$(digit),$(lang),$(region)and the other built-in variables stand for one letter, digit, language code or region code. - Android documents its
*more narrowly: it takes characters only up to the first place where the pattern’s next character appears.*.pdftherefore does not matcha.b.pdfthere. The URL test marks results where this matters.
The rules come from Apple’s components reference and Android’s dynamic rules guide.
Serving the files
- Apple:
https://<domain>/.well-known/apple-app-site-association, with no.jsonextension, over HTTPS with a valid certificate and no redirects. Since iOS 14 devices download it from Apple’s CDN, which must be able to fetch it from any IP address and with any user agent (TN3155). - Android:
https://<domain>/.well-known/assetlinks.json, served asContent-Type: application/json, over HTTPS even when your app also handleshttplinks, with no 301 or 302 redirects, on every host your intent filters name (Android’s guide). - A wildcard (
*.example.com) is served from the parent domain on both platforms; a specific subdomain needs the files on its own host. - After a change, Apple’s CDN fetches the file again within about a day and devices check about once a week; Android 15 and later re-verify in the background (up to seven days), older versions when the app is installed or updated.
Why a link still opens in the browser
- iOS: typing or pasting the URL into Safari’s address bar never opens the app, and a tap on a link to the same domain you are browsing stays in Safari. Test from the Notes app instead: a long press on the link offers to open it in the app or in the browser.
- iOS: the app’s entitlement must list the exact domain (
applinks:www.example.comis not covered by a file onexample.com), with no port, and the app ID must be Team ID + bundle ID of the build on the device. - Android:
android:autoVerify="true"must be on the intent filter, with thehttpsscheme (andhttpif your links use it) and the hosts; the fingerprint must be the one of the certificate that signed the installed build (debug, release or Play App Signing). - Both: a redirect, a login wall, a firewall or a bot filter in front of
/.well-known/makes verification fail.
Limitations
- The page cannot fetch your live files (browsers block reading other sites): paste their contents to check them, and use the commands and links of the Hosting checklist to see what Apple and Google read.
- The URL test follows Apple’s and Google’s documented matching rules;
$(lang)and$(region)are approximated as any two-letter region code and any two- or three-letter language code. - Rules in the builder apply to every app in the file; to give different apps different paths, paste and edit the generated file, then check it here.
- Android path filters in the manifest cannot exclude paths or test queries; such rules apply only through Android 15 dynamic rules or your own code.
Privacy
Everything happens in your browser. What you enter or open here is not uploaded or stored by MySmartCoPilot.
Frequently asked questions
What do I get without a pass?
Without a pass, Universal Links & App Links File Generator shows the first lines of each file (up to 20), and every count of a file check or URL test with its first rows (up to 10). Until you unlock it, the result can’t be downloaded or copied. A Pro, Premium or Ultimate pass, a one-time payment that never renews, unlocks the full result. The pricing page lists the passes and their prices.
Where do I find my Team ID and the SHA-256 fingerprint?
The Team ID is shown in your Apple Developer account and is also the prefix of your App ID (the ABCDE12345 in ABCDE12345.com.example.app). For Android, keytool -list -v -keystore my-release-key.keystore prints the SHA-256 fingerprint of your own key; if Play App Signing is on, the key Google signs your app with is the one users’ devices see: Play Console shows its fingerprint, and a ready Digital Asset Links snippet, under Release > Setup > App signing.
Should the apple-app-site-association file have a .json extension?
No. Apple’s documentation names it apple-app-site-association without an extension. If your browser adds .json when downloading, rename it before uploading, and set the server to send it as application/json (the Hosting checklist has settings for Nginx, Apache and hosts that read a _headers file, such as Netlify).
Do I need "apps": [] in the applinks section?
No. apps belongs to the old format (appID with paths), which Apple’s TN3155 still describes. The format Apple documents now uses appIDs and components and no apps key, and TN3155 asks you not to mix the two.
What are Android 15 dynamic rules?
Since Android 15, assetlinks.json can carry path, query and fragment rules (dynamic_app_link_components) that refine the scope your app’s manifest declares, so you can change which URLs open the app without shipping an update. They cannot widen the manifest’s scope, so declare the scheme and hosts broadly there. Older Android versions ignore them.
Is anything I enter sent anywhere?
No. The files are built and checked in your browser. The links in the Hosting checklist open Apple’s CDN and Google’s Digital Asset Links API in a new tab only when you click them, and they contain only your domain.