Android app protection

Harden the build. Verify the device. Trust the request.

Azar protects Android apps in three parts. Attest tells your backend a request came from your real app on a real device, Core watches the app while it runs, and Shield hardens it before it ships.

Start free See the three products

Azar Attest is free up to 1,000 verifications a month
Works outside Google Play
Hardware key attestation

Your appHardware-backed Keystore key

attestation chain

Azar verifierChain, build and policy checks

signed token

Your backendTrusts the request, or doesn't

// POST /azar/attest/api/v1/verify
{
  "verdict": "HARDWARE_VERIFIED",
  "allowed": true,
  "token":   "eyJ…"   // Ed25519, short-lived
}

The answer Azar Attest gives your app. Your backend verifies the token against Azar's public key set.

Three products

Pick the part you need

Each one works on its own. Azar Attest is sold online. Azar Core and Azar Shield are by arrangement.

On every requestBuy

Azar Attest

Your app proves its identity with a hardware-backed key. Azar verifies the proof and returns a short-lived signed token your backend can trust.

Details and pricing

While it runsContact us

Azar Core

A native library inside your app looks for tampering, root, emulators, debuggers and hooking, and gives your code a verdict to react to.

Details

At build timeContact us

Azar Shield

A managed cloud build with a Gradle plugin that obfuscates your code, encrypts strings and scatters integrity checks through your own call sites.

Details

Azar Attest

Buy

Let your backend ask, and get a straight answer

A hosted verifier for Android hardware key attestation. No hardening required, and no dependence on Google Play Integrity.

What it is: A hosted verifier for Android hardware key attestation, with a small SDK and a Gradle plugin.
Where it runs: On Azar's servers. Your app asks for a challenge and sends back a certificate chain.
How you buy: Online, per app per month, starting free.

How it works

Challenge

The app gets a single-use 32-byte challenge. It expires after 120 seconds.

Attest

The app attests a Keystore key against that challenge and sends back the certificate chain.

Verify

Azar checks the chain against Google's attestation roots and revocation list, then the package, signing certificate and build.

Token

Azar returns a short-lived Ed25519 token. Your backend verifies it with Azar's public key set.

What you get

Pinned to your builds

A Gradle plugin registers each release's version code and signing certificate. A build you expire can no longer verify.

Policy you control

Require a locked bootloader, verified boot, or a minimum security patch level. Decide whether software-only or unsupported devices pass.

Quota you can see coming

Alerts at every 10% from 60% to 120% of your monthly quota, and a request flood is rate limited before it can drain it.

Gentle when a term ends

After a subscription ends, verification keeps working for another 20% of the term before it blocks.

Works where Play Integrity can't. Apps distributed through other stores, inside a company, or sideloaded are verified the same way as apps on Google Play.

Pricing for Azar Attest

Start free, pay when an app grows

These prices are for Azar Attest only. Priced per app, per month, with a monthly allowance of verifications.

Free

0 toman / app / month

For development and small apps.

1,000 verifications a month
Hardware key attestation
Signed tokens and public key set

Start free

Standard

2,250,000 toman / app / month

For apps in production.

30,000 verifications a month
Build registration plugin
Quota alerts and rate limiting
Usage between 100% and 120% still verifies, and is billed at renewal

Get started

Scale

17,250,000 toman / app / month

For high-volume apps.

3,000,000 verifications a month
Everything in Standard
Usage up to 120% still verifies, and is billed at renewal

Get started

Need more than 3,000,000 verifications, or custom terms? Contact us.

Get started

Your first verified launch, in an afternoon

Register the app

Create the app, add its package name and signing certificate, and receive its app key.

Add the SDK and plugin

The Android library asks for a challenge and attests a key. The Gradle plugin registers each release build.

Check the token

Verify Azar's signed token on your backend and decide what a failed verdict should block.

Create your account Sign in

Azar Core

Watch the app while it runs

A native runtime library for Android. It collects many small signals about the device and the app, scores them, and hands your code a verdict to act on.

What it is: A native library with a Kotlin API that you add to your app.
Where it runs: Inside your app, on the user's device.
How you buy: By arrangement. Contact us for terms.

What you get

Checks for tampering, root, emulators, debugging and hooking
A weighted score and a TRUSTED, SUSPECT or COMPROMISED verdict
Weights and thresholds that you set
A callback of your own, so you decide how the app reacts

What it checks

Tamper

Signing certificate pinned to your hashes, install source, a debuggable flag on a release build, and TLS pin mismatches.

Root and emulator

su and busybox, Magisk and KernelSU traces, a writable system partition, risky build properties, emulator signatures, and app cloners or virtual spaces.

Debug and hooking

An attached debugger, Frida, Xposed, LSPosed, Riru and Zygisk in memory, and Frida server files on disk.

Hard to find

Opaque check identifiers, strings decrypted in native code, and re-checks that fire after a random delay from scattered call sites.

Try the scoring

Switch on what a device is showing. This uses Azar's default thresholds (suspect at 40, compromised at 70) and each check's confidence.

Weight given to every signal
You set this per signal in your app. The default is 25. 25

TRUSTEDrisk 0 / 100

Azar Core is sold by arrangement. Contact us.

Azar Shield

Harden the app before it ships

A managed cloud build service with a Gradle plugin. It makes the release build hard to read and hard to patch, and proves the protections are really in it.

What it is: A managed cloud build service and a Gradle plugin for your Android project.
Where it runs: At build time, in Azar's cloud. What you ship is the hardened release build.
How you buy: By arrangement. Contact us for terms.

What happens to your build

Obfuscate

Names are shrunk and obfuscated, and log calls are stripped from release builds.

Encrypt strings

Strings are encrypted at build time and decrypted in native code.

Scatter checks

Azar Core's integrity checks are injected through your own call sites, so there is no single line to patch out.

Verify

A verifier proves the protections are really in the release build.

Azar Shield is sold by arrangement. Contact us.

Plainly

What Azar doesn't do

It does not make an app unbreakable. Azar raises the cost of attacking your app and tells your backend what it can see. A determined attacker with enough time can still get through.
Android only. There is no iOS version.
Hardware attestation needs Android 7 or newer. Older devices report as unsupported, and your policy decides whether they pass.
A hidden root can slip past signature checks. That is why Azar combines many weak signals and lets you set how much each one counts.

Contact

Azar Core and Azar Shield

Both are sold by arrangement. Tell us about your app and what you need, and we will reply with terms.