Mobile apps

Android is built on the Linux kernel, and its core is open source as the Android Open Source Project (AOSP). Most phones sold outside China also carry Google Mobile Services, the proprietary layer that includes Google Play, Play services, Maps and push messaging through Firebase Cloud Messaging. Apps are written in Kotlin (or Java) against the Android SDK and run on the Android Runtime (ART). Publishing on Google Play costs a one-time $25.

The variety is both the strength and the challenge: thousands of device models, screen sizes and Android versions, with manufacturers adding their own skins and battery rules. Apps can come from Google Play, other stores such as Samsung's Galaxy Store, or direct downloads (sideloading). From 30 September 2026 Google starts requiring apps on certified devices to be registered by verified developers, beginning with installs from major stores in Brazil, Indonesia, Singapore and Thailand and extending to all apps worldwide in 2027.

A Compose screen is made of composable functions, Kotlin functions marked @Composable that emit interface elements such as Text, Button and LazyColumn (a scrolling list). They read state, and when that state changes Compose re-runs only the affected functions, a process called recomposition. There are no XML layout files and no manual view updates, which removes a whole class of bugs where the screen and the data drift apart.

Google recommends Compose for new Android apps. It replaces the older View system (XML layouts), although the two can live side by side in one app. Material 3 components, animation, navigation and Android Studio previews are built around it. The same model runs on Wear OS and Android TV, and JetBrains' Compose Multiplatform brings it to iOS, desktop and the web.

Android Studio is an IDE (integrated development environment) built on JetBrains' IntelliJ IDEA. It bundles the Android SDK tools, the Gradle build, the Android Emulator for running virtual phones, tablets and watches, Compose previews, a Layout Inspector, Logcat for reading app logs, profilers for memory, CPU and battery, and the APK Analyzer. Gemini in Android Studio adds AI help for writing code and explaining crashes.

It runs on Windows, macOS, Linux and ChromeOS, and it is also the usual place to open the Android half of a Flutter, React Native or Capacitor project. Signing a release build and producing an AAB for Google Play can be done from its menus.

Material Design 3, also called Material You, defines components such as buttons, cards, navigation bars and dialogs, and a colour system built from tokens (named roles such as primary and surface). On Android 12 and later, dynamic colour can build an app's palette from the user's wallpaper. Material 3 Expressive, a 2025 update, adds bolder shapes, springier motion and more ways to give elements emphasis.

Developers use it through libraries: Compose Material 3 on Android, Material Components for the older View system, and Flutter's built-in Material widgets. Following it makes an app feel at home on Android. iPhone apps normally follow Apple's Human Interface Guidelines instead, which is why cross-platform apps often adapt their look to each platform.

A suspend function can pause at a slow call and resume later without blocking a thread, so asynchronous code reads top to bottom like ordinary code instead of nested callbacks. Coroutines run in scopes tied to a lifetime, such as viewModelScope for a screen's ViewModel, and are cancelled automatically when that scope ends (structured concurrency). Dispatchers choose where work runs: Main for the interface, IO for disk and network.

Flow is a stream of values over time: a Room query that re-emits when rows change, search results as the user types, a download's progress. StateFlow holds the current UI state that Compose screens observe. Both come from JetBrains' kotlinx.coroutines library, work in Kotlin Multiplatform, and have largely replaced callbacks and RxJava in new Android code.

Gradle runs tasks described in build scripts, now usually written in Kotlin (build.gradle.kts). The Android Gradle Plugin (AGP) adds the Android-specific steps: compiling Kotlin, running KSP, merging resources, shrinking code with R8, signing, and packaging an APK or AAB. Build variants combine build types (debug, release) with product flavours (free, paid) from one project.

Dependencies are declared by name and version and fetched from repositories such as Maven Central and Google's Maven; a version catalog (libs.versions.toml) keeps those versions in one file. The Gradle wrapper (gradlew) pins the Gradle version so every machine builds the same way. Gradle also builds Java, Kotlin Multiplatform and Spring projects, and its build cache and configuration cache help with slow builds.

Dependency injection (DI) means a class declares what it needs, typically in its constructor, and something else supplies it. Dagger does this with generated code: annotations such as @Inject and @Module describe how to build each object, and a code generator writes the wiring at build time, so a missing dependency is a compile error rather than a crash. Hilt, from Google, sits on top of Dagger and removes most of its setup on Android.

With Hilt you annotate the Application class with @HiltAndroidApp, screens with @AndroidEntryPoint and ViewModels with @HiltViewModel; modules marked @InstallIn tie each object to a lifetime, such as the whole app or a single screen. Tests can swap in a fake repository. Dagger and Hilt support KSP, which builds faster than the older kapt. Hilt is Android-only, so Kotlin Multiplatform projects often use lighter options such as Koin.

Many libraries work by reading annotations in your code and generating the repetitive parts: Room writes the database plumbing for a DAO, Hilt writes the dependency wiring. kapt did this by first generating Java stubs so that Java annotation processors could run, which was slow. KSP, made by Google, reads Kotlin code directly, and Google reports it can be up to twice as fast.

kapt is in maintenance mode, so projects move to KSP by swapping kapt(...) for ksp(...) in the Gradle file once every processor they use supports it. KSP also works in Kotlin Multiplatform, which kapt never did, and Room 3 requires it.

You describe tables as Kotlin data classes marked @Entity, and queries in a DAO (data access object) interface as functions with SQL in an @Query annotation. At build time Room's code generator, running under KSP, checks every query against the schema, so a misspelt column breaks the build instead of the app, and writes the code that maps rows to objects.

Queries can return a Flow, so a list on screen refreshes by itself when rows change. Schema changes are handled with migrations, many of which Room can generate automatically. Room gained Kotlin Multiplatform support, running on Android, iOS and desktop, and Room 3, released in 2026, is Kotlin-first, requires KSP and coroutines, and adds JavaScript and WebAssembly targets.

Preferences DataStore stores key-value pairs; Proto DataStore stores a typed object defined with Protocol Buffers. Both read and write asynchronously with coroutines and expose data as a Flow, so a settings screen updates as soon as a value changes and nothing blocks the main thread, a common cause of freezes with SharedPreferences.

Writes are transactional, so a crash halfway through cannot leave a corrupted file. It is meant for small data: anything with many records, relationships or queries belongs in Room. DataStore also works in Kotlin Multiplatform. It does not encrypt anything by itself, so tokens and other secrets should be encrypted with a key from the Android Keystore.

You describe a unit of work (a Worker class) and the conditions for running it, such as only on Wi-Fi, only while charging, or with retries and back-off if it fails. WorkManager stores the request in its own database and hands it to the system scheduler, so it survives app restarts and reboots. Jobs can be one-off or periodic (every 15 minutes at the shortest), chained together, and tagged for tracking.

It is for deferrable work that must get done, not for exact timing: an alarm at 7:00 needs AlarmManager, and a long task the user is watching, such as music playback, needs a foreground service. Android limits background activity to save battery, and some manufacturers restrict it further, so WorkManager is Google's recommended way to get guaranteed work done.

Widgets do not run inside your app: the launcher draws them from a description called RemoteViews, which supports only a limited set of layouts. Glance lets you write that description with composable functions such as Column, Row, Text, Image and Button, then translates it into RemoteViews. It supports Material 3 theming, including dynamic colour, and actions that open the app or run a callback.

Because of RemoteViews, Glance composables are not the same as Compose ones: there is no custom drawing, animation is limited, and the component set is separate. Widgets update when the app pushes new data or on a schedule, often through WorkManager, and Android limits how often they refresh to save battery.

OkHttp, from Square, is an HTTP client that handles connection reuse, HTTP/2, compression, caching, retries, timeouts and WebSockets. Interceptors let an app add an auth header to every request, log traffic or refresh an expired token in one place, and certificate pinning can restrict which server certificates the app trusts.

Retrofit sits on top: you write an interface with one annotated function per endpoint (for example @GET with a path), and Retrofit generates the networking code, turning JSON into Kotlin objects through a converter such as kotlinx.serialization, Moshi or Gson. Both target the JVM and Android, so Kotlin Multiplatform code usually uses Ktor's HTTP client for the same job.

Mark a data class @Serializable and a Kotlin compiler plugin generates its serializer, so encoding and decoding need no reflection. That makes it fast, friendly to R8 shrinking, and usable on every Kotlin Multiplatform target, unlike reflection-based libraries such as Gson. JSON is the main format; Protobuf, CBOR and others are available.

Options cover real-world APIs: ignoreUnknownKeys for servers that add fields, default values for missing ones, @SerialName for fields named differently on the wire, and polymorphic types. Ktor and supabase-kt use it, and Retrofit has a converter for it.

supabase-kt is split into modules you add as needed: postgrest-kt for querying tables, auth-kt for sign-in, storage-kt for files, realtime-kt for live changes and functions-kt for Edge Functions. It is built on Ktor and kotlinx.serialization, with coroutines and Flow throughout, and targets Android, iOS, desktop JVM and the web.

It is maintained by the Supabase community rather than by Supabase itself, although the official docs include its reference. Because the app talks to the database directly with the public key, row level security policies on every table are what keep the data safe.

Instead of separate libraries for passwords, passkeys and Google sign-in, an app makes one getCredential call and Android shows a bottom sheet listing what the user has saved for that app. It also saves new passwords and creates passkeys. From Android 14 it works with third-party password managers as well as Google Password Manager, and it replaces the deprecated Google Sign-In, One Tap and Smart Lock APIs.

Passkeys need a Digital Asset Links file (assetlinks.json) on the website, so the app and the site can share credentials. The sheet only hands the app a credential: the app still sends the resulting ID token or passkey response to its server, which must verify it before starting a session.

R8 is the Android build's code shrinker. With isMinifyEnabled switched on for release builds, it removes classes and methods nothing uses, optimises the rest, renames classes and members to short meaningless names (obfuscation), and converts the result into the DEX format Android runs. isShrinkResources then drops unused images and layouts. ProGuard, from Guardsquare, is the older tool R8 replaced, and its rule syntax lives on in proguard-rules.pro files.

Code reached only through reflection, or JSON parsed by field name, can be removed or renamed by mistake, so libraries ship keep rules and apps add their own; testing the release build, not only debug, catches this. R8 writes a mapping.txt file that turns obfuscated crash stack traces back into readable ones, and Play Console can use it to show readable crash reports. Obfuscation slows reverse engineering but does not stop it.

iOS apps are written in Swift (or the older Objective-C) with SwiftUI or UIKit, built in Xcode, and run in a sandbox with strict rules on background work, permissions and privacy, such as asking before tracking users across other companies' apps. Apple makes both the hardware and the software, so there are far fewer device models and system versions to test than on Android, and most users update quickly.

Building an iOS app needs a Mac with Xcode (or a cloud build service), and publishing needs the Apple Developer Program at $99 a year. Apps reach users through the App Store after App Review; in the EU and Japan, local laws also allow alternative app marketplaces. Push notifications go through APNs (Apple Push Notification service).

A SwiftUI view is a Swift struct whose body combines smaller views: Text, Image, Button, List, and stacks for layout. State is declared with property wrappers and macros such as @State and @Observable, and when it changes SwiftUI recomputes the affected views. Xcode Previews show the result live while you type.

Introduced in 2019, SwiftUI is the framework Apple now builds around, and some features, such as widgets and Live Activities, can only be built with it. UIKit, the older imperative framework, still powers much of iOS and fills gaps, and the two interoperate, so a SwiftUI app can host a UIKit view and the reverse. Newer SwiftUI features only work on recent iOS versions, which limits them in apps that support older phones.

Xcode bundles the Swift compiler, a code editor, SwiftUI previews, Interface Builder, the iOS Simulator, the Instruments profiler and the tools that sign apps and upload them to App Store Connect. Every iOS build, including those from Flutter, React Native or Capacitor projects, ends up going through Xcode's build tools.

Signing uses certificates and provisioning profiles, which Xcode can manage automatically for a developer account. Xcode Cloud, Apple's CI service, builds and tests in the cloud and delivers builds to TestFlight. Teams without a Mac rely on cloud Macs or services such as EAS Build.

Builds uploaded to App Store Connect can go to up to 100 internal testers (members of your team) straight away, and to up to 10,000 external testers by email or public link once the first build has been approved by Apple's beta review. Testers install the TestFlight app, get notified about new builds, and can send screenshots, feedback and crash reports.

Each build stays testable for 90 days. Unlike Google Play with new personal accounts, Apple has no minimum closed-testing period before release, but the final version still goes through full App Review.

Flutter apps are trees of widgets written in Dart. Rather than using the platform's own buttons and lists, Flutter paints its own interface with its rendering engine (Impeller, now the default on iOS and most Android devices), so a screen looks identical on every phone. Release builds are compiled ahead of time to native machine code, and during development hot reload shows code changes in the running app almost instantly.

It ships two widget sets, Material (Android style) and Cupertino (iOS style), and pub.dev hosts packages for cameras, maps, payments and much more. Native features no package covers are reached through platform channels, small bridges to Kotlin or Swift code. The same code can target the web, Windows, macOS and Linux, although web output is heavier and less search-friendly than a normal website.

You write React components (View, Text, Pressable, FlatList) and React Native renders them as the platform's own views, so a list is a real native list. JavaScript runs in Hermes, an engine built for mobile, and since late 2025 the framework runs only on its New Architecture: the Fabric renderer and TurboModules reach native code directly through JSI instead of the old asynchronous bridge.

Most new projects start with Expo, which the React Native docs recommend. Web developers can reuse React skills, state libraries and some business logic. Because the JavaScript bundle can be replaced without a store release, over-the-air updates can ship fixes quickly within store rules. Meta, Microsoft and Shopify use it in production apps.

The open-source side is the Expo SDK (ready-made modules for the camera, notifications, files, sensors and more), Expo Router for file-based navigation, and tooling that generates the native Android and iOS projects from a config file, so upgrading React Native is far less painful. Expo Go lets you try an app on a phone by scanning a QR code; apps with custom native code use a development build instead.

EAS (Expo Application Services) is the cloud side: EAS Build compiles Android and iOS apps in the cloud, so an iPhone app can be built without a Mac; EAS Submit uploads builds to the stores; EAS Update pushes JavaScript fixes straight to installed apps; and Workflows automate the pipeline. Each service is optional and can be swapped for local builds or other CI.

Shared code lives in a common module and compiles to each platform's native form: JVM bytecode on Android, a native framework on iOS (through Kotlin/Native), JavaScript or WebAssembly on the web. Where a platform needs its own implementation, expect and actual declarations mark the gap. Ktor, kotlinx.serialization, coroutines, Room, DataStore, SQLDelight and supabase-kt all work in shared code.

Teams choose how much to share. Many keep native interfaces (Jetpack Compose on Android, SwiftUI on iOS) and share networking, storage and business rules; others share the interface too with Compose Multiplatform, whose iOS support became stable in 2025. Google officially supports KMP for sharing logic, and it can be added to an existing Android app one module at a time.

You build a normal web app with any framework (React, Vue, Angular, Svelte), then Capacitor copies the built files into native Android and iOS projects, where they run in the system WebView. JavaScript calls plugins such as @capacitor/camera, which run native code and return the result. The native projects are ordinary Android Studio and Xcode projects kept in your repository, so custom native code can be added anywhere.

It is the modern successor to Apache Cordova and works with many existing Cordova plugins. Official plugins cover the basics, and community groups such as Capawesome add many more. Ionic's paid cloud services for it (Appflow builds and live updates) stopped taking new customers in 2025 and are due to close at the end of 2027; third parties offer similar services.

Ionic Framework provides Web Components styled to match each platform automatically: an iPhone gets iOS-style navigation and fonts, an Android phone gets Material Design. It has official packages for Angular, React and Vue, plus page transitions, router integration and gestures, so a web app feels like a mobile app rather than a website.

The company behind it, owned by OutSystems since 2022, pairs it with Capacitor for native access, and both stay free and open source. Its paid products (Appflow, Identity Vault, Auth Connect and others) stopped taking new customers in 2025 and reach their final end of life at the end of 2027. Ionic began as an Angular project and remains popular with Angular teams.

A TWA is a tiny Android app that launches your PWA in the user's browser (usually Chrome) without any browser interface, so it looks like a native app while sharing the browser's cookies, storage and service worker. To prove you own the site, the website hosts a Digital Asset Links file (/.well-known/assetlinks.json) containing the app's signing key fingerprint; if that check fails, the address bar appears.

Bubblewrap, a command-line tool, and PWABuilder generate the project and the AAB for Google Play. Changes to the website appear in the app immediately, with no store release. The limits: Android only (iOS has no equivalent), phone features are only those the web platform offers, and the site must meet PWA basics such as a web app manifest and HTTPS.

Each platform has one: Android System WebView (based on Chromium and updated through Google Play), WKWebView on iOS and macOS (Safari's WebKit engine), WebView2 on Windows (Microsoft Edge's engine) and WebKitGTK on Linux. Apps use them for help pages, checkout flows and embedded content, and frameworks such as Capacitor, Cordova and Tauri use them to run the entire interface.

The app can talk to the page through a JavaScript bridge, which is useful but also a risk: a WebView that loads untrusted pages and exposes native functions to them can be abused. Google blocks its sign-in inside embedded WebViews, and OAuth guidance calls for the system browser (Custom Tabs on Android, ASWebAuthenticationSession on iOS) instead.

On Android the key lives in a keystore file (.jks) protected by passwords. With Play App Signing, which new apps on Google Play must use, Google keeps the real app signing key and you sign uploads with a separate upload key; if the upload key is lost or leaked, Google can reset it. Before this, losing the key meant never being able to update the app again, so the keystore and its passwords still belong in a password manager and a backup, never in the code repository.

On iOS, signing uses certificates and provisioning profiles issued through the Apple Developer Program, which state which developer, which app and, for test builds, which devices. Xcode and services such as EAS can create and renew them automatically. It is the mobile counterpart of desktop code signing.

An APK (Android Package) contains the compiled code, resources and manifest, and can be installed directly, which is how sideloading and most other stores work. An AAB holds everything for every kind of device; Google Play splits it into APKs matched to each phone's screen density, processor and language, so downloads are smaller. Since August 2021, new apps on Google Play must be uploaded as AABs, which also means using Play App Signing.

An AAB cannot be installed on a phone directly. bundletool, Google's command-line tool, turns it into installable APKs for testing, and Play's internal testing track does the same in the cloud. Debug builds for your own devices are still APKs.

An app moves through tracks: internal testing (up to 100 testers), closed testing for invited groups, open testing, and production, where a staged rollout can release an update to a percentage of users first. Before launch every app needs a store listing, a content rating questionnaire, a Data safety form describing the data it collects and a target audience declaration, and each release is reviewed, which can take from hours to several days.

A new personal developer account must run a closed test with at least 12 testers opted in for 14 continuous days before it can apply for production access. Organisation accounts, which need a D-U-N-S number (a free company identifier from Dun & Bradstreet), skip that step. Google also raises the minimum target Android version every year, so an app that is never updated eventually stops being offered to new users on newer phones.

Android vitals report crash and ANR (app not responding) rates, which also affect how visible an app is in the store. The registration fee is paid once. The service fee on paid apps, in-app purchases and subscriptions depends on the region: from mid-2026 the US, UK and EEA moved to lower service fees with a separate billing fee, and other regions follow on a published schedule.

Using it requires the Apple Developer Program. Individuals enrol under their legal name, which appears as the seller on the App Store; organisations need a D-U-N-S number and a working company website. Each app needs screenshots, a description, an age rating and privacy details (the 'nutrition label' of what data the app collects), and in-app purchases and subscriptions are set up here too.

Every version, including small updates, goes through App Review against Apple's guidelines, typically within a day or two; a rejection cites a guideline and can be answered or appealed. There is no closed-testing requirement like Google Play's, but review is stricter about minimum functionality, privacy and in-app payments. Phased release spreads an automatic update over seven days, and App Analytics reports downloads, sales and crashes.

The simplest form is a custom scheme such as myapp://product/42, but any app can claim a scheme and the link fails when the app is missing. Verified links use ordinary https URLs instead: Android App Links need an assetlinks.json file under /.well-known/ on the website listing the app's signing key fingerprint, and iOS Universal Links need an apple-app-site-association file plus the Associated Domains setting in the app. Since Android 12, web links open in the browser unless the domain is verified.

If the app is not installed, a verified link simply opens the website, which should show the same content. Deferred deep links, which carry the destination through a fresh install, need an attribution service such as Branch or AppsFlyer, since Firebase Dynamic Links shut down in August 2025.