Where does assetlinks.json go?

At https://your-domain/.well-known/assetlinks.json, served over HTTPS with Content-Type application/json and without redirects, on every host your app's intent filters list.

Where does apple-app-site-association go?

At https://your-domain/.well-known/apple-app-site-association, with no .json extension, served over HTTPS without redirects, preferably as application/json, and smaller than 128 KB.

Why don't my Universal Links work after I updated the file?

iPhones download the file through Apple's CDN, not from your server. Apple refreshes its copy on its own schedule, usually within a day, so changes take time to reach devices. This validator shows whether Apple's CDN already has the same file as your server.

Which SHA-256 fingerprint goes in assetlinks.json?

The fingerprint of the key that signs the app users install. With Play App Signing that is the app signing key shown in Play Console under Test and release > App integrity; add your upload key's fingerprint too if you install builds signed with it.

assetlinks.json & apple-app-site-association Validator (App Links, Universal Links)

App Links & Universal Links validator

Check your assetlinks.json and apple-app-site-association the way Android and iOS read them, and see what Google and Apple's CDN actually have.

Try: ·

Create the files

assetlinks.json

Upload to https://your-domain/.well-known/assetlinks.json.

Package name SHA-256 fingerprints (one per line; app signing key from Play Console) Also share saved passwords (get_login_creds)

apple-app-site-association

Upload to https://your-domain/.well-known/apple-app-site-association (no extension).

Team ID Bundle ID Paths (one per line; start with ! to exclude) Also share saved passwords (webcredentials)

What the validator checks

Location and transport: the file is at /.well-known/ on the exact host, over valid HTTPS, answers 200, and doesn't redirect. Neither platform follows redirects for these files.
Format: valid JSON, served as application/json, not an HTML error page, and under 128 KB for Apple.
assetlinks.json: an array of statements with the delegate_permission/common.handle_all_urls relation, an android_app target, a valid package name and SHA-256 fingerprints in AB:CD:… form.
apple-app-site-association: an applinks section with App IDs in TEAMID.bundle.id form and components (or legacy paths), plus webcredentials and appclips when present.
What the platforms see: Google's Digital Asset Links API result for your domain, and whether Apple's CDN, which iPhones download from, already has the same file as your server.

Common reasons links open the browser instead of the app

The file redirects, for example from example.com to www.example.com. Each host needs its own file without redirects.
The fingerprint is the upload key's, but Google Play re-signs the app with the app signing key. Copy it from Play Console › Test and release › App integrity.
The iOS App ID uses the bundle ID without the Team ID prefix.
Apple's CDN still serves an older copy; it usually refreshes within a day.
The app's intent filters (android:autoVerify="true") or Associated Domains entitlement (applinks:example.com) don't list the host.