Android Deep Links vs App Links: How They Work and How to Check Them

By the Paxio team · October 6, 2026 · 6 min read

A deep link is a link that opens a specific screen inside an Android app instead of just launching it. Verified App Links are the safer kind: Android confirms the website really belongs to the app, so the link opens the app directly with no chooser.

What a deep link is

Normally you open an app from its icon. A deep link lets a URL jump straight to a place inside it: a product page, a chat, a payment confirmation. Apps register for these links by declaring an intent filter in their manifest with a VIEW action, usually the BROWSABLE category, and a data element describing the URL pattern.

Three kinds of link

Android describes App Links as a deep-linking capability in Android 6 and later that lets verified website URLs open the matching content in your app immediately, without a disambiguation dialog.^[1]

How App Link verification works

1. The app adds android:autoVerify="true" to an intent filter. When it is present in at least one filter, installing the app on Android 6.0 (API level 23) or higher makes the system verify the hosts in its filters.^[2]
2. Android fetches a Digital Asset Links file from each host at https://hostname/.well-known/assetlinks.json.^[2]
3. If the file lists the app's package name and signing certificate, the link is verified and opens in the app.

On Android 11 (API level 30) and lower, the system makes the app the default handler for those URL patterns only if it finds a matching Digital Asset Links file for all hosts in the manifest.^[2]

The file's sha256_cert_fingerprints ties the website to a specific signer, which is why app signing matters here. Paxio uses the same mechanism: its website serves an assetlinks.json for the Paxio app.

The security risks

• Custom schemes can be claimed by more than one app. Because nothing verifies ownership, a malicious app can register the same scheme and try to intercept links meant for another app, so avoid putting sensitive tokens in them.
• Deep links are an entry point. Any app or web page can fire one, so the data it carries is untrusted input and must be validated. Android's guidance on exported components applies, since a deep-link activity must be exported to be reachable.^[3]
• Unverified web links can open a chooser and let a look-alike app compete for the click.
• Broad patterns expose more. A filter matching a whole domain exposes more screens than one limited to specific paths.

OWASP groups this under the platform-interaction controls in MASVS-PLATFORM.^[4]

How to read deep links in a manifest

<activity android:name=".LinkActivity" android:exported="true">
  <intent-filter android:autoVerify="true">
    <action android:name="android.intent.action.VIEW"/>
    <category android:name="android.intent.category.DEFAULT"/>
    <category android:name="android.intent.category.BROWSABLE"/>
    <data android:scheme="https" android:host="example.com" android:pathPrefix="/app"/>
  </intent-filter>
</activity>

Reading it: an exported activity, a VIEW and BROWSABLE filter, an https scheme and autoVerify, so this is a verified App Link for example.com/app. A data element with a made-up scheme and no autoVerify would be a custom-scheme deep link.

You do not have to read this by hand. Upload the APK to the APK analyzer: its Deep links table lists each link and labels it a verified App Link, an unverified web link or a custom-scheme deep link, with the component that handles it.

Good practice for developers

• Prefer verified App Links over custom schemes for anything user-facing.
• Validate and sanitize every parameter; never trust a deep link to carry authority.
• Keep filter patterns as narrow as the feature needs.
• Confirm that assetlinks.json is served over HTTPS and lists the correct package and signing fingerprint.
• Check the shipped APK, not just the source, to make sure the links behave as intended.

Analyze an APK →