Decompile FrankenKeys yourself, with the commands

Release builds of FrankenKeys ship without obfuscation, on purpose. That is only useful if somebody actually opens one, so here is the whole procedure, from a phone with the keyboard installed to a screen showing the manifest and the source. It takes about ten minutes the first time.

You need adb from the Android SDK platform tools, and jadx, which is free and open source. Nothing else.

1. Find the APK on the phone

Plug the phone in with USB debugging on, then:

adb shell pm path studio.forgedev.forgeboard

You will see one or more lines beginning package:. An app installed from Play is split into a base APK and a few configuration splits (screen density, native ABI). The base is the one with the code:

package:/data/app/~~XXXX==/studio.forgedev.forgeboard-YYYY==/base.apk

2. Pull it

adb pull "/data/app/~~XXXX==/studio.forgedev.forgeboard-YYYY==/base.apk" frankenkeys.apk

Use the exact path your phone printed. That file is what Android is running.

3. Read the permission list without opening anything

Two quick options before the decompiler. With the Android SDK's apkanalyzer:

apkanalyzer manifest permissions frankenkeys.apk

Or with the older aapt:

aapt dump permissions frankenkeys.apk

Both print the uses-permission entries from the binary manifest. Expect five. The full list, with reasons, is one page over. There is no android.permission.INTERNET.

4. Open it in jadx

jadx-gui frankenkeys.apk

In the tree on the left, expand Resources and open AndroidManifest.xml. jadx decodes the binary manifest back to readable XML, and the five uses-permission lines are near the top.

Then expand Source code. Because the build passes -dontobfuscate to R8, the packages have their real names. You will find studio.forgedev.forgeboard.ime.ForgeInputMethodService, which is the keyboard itself, studio.forgedev.forgeboard.vtt.VoiceInputController, studio.forgedev.forgeboard.clipboard.ClipboardVault, and so on. The names are the ones in the source tree, not a.b.c.

5. What to actually look at

If you only have five minutes, these are the classes that carry the claims on this site:

• ime/FieldPolicy decides what the keyboard may do in each kind of field. Password fields get no suggestions, no autocorrect, no learning and no clipboard capture, and the table in the class comment matches the code below it.
• clipboard/ClipboardVault holds clipboard history in memory, capped at ten entries, each with its own expiry. The only thing it writes to disk is a clip you explicitly pin.
• vtt/VoiceInputController creates the recogniser with createOnDeviceSpeechRecognizer on API 31 and up, and refuses to fall back to a network recogniser on that platform.
• core/KnowledgeReport is the inventory behind the in-app Privacy page, "What this keyboard knows about you", one row per store, each with its own wipe.
• billing/Pro is the only class allowed to ask whether Pro is unlocked, and the backup exporter strips its flags so a backup file cannot become a licence.

6. Confirm the build is the build

If you want to go one step further, compare what you pulled against what Play says it installed. In the Play Store app, the listing's About this app section shows the version, and adb shell dumpsys package studio.forgedev.forgeboard | grep versionName shows what is on the phone. At the time of writing that is 3.13.0. A decompiled 3.13.0 is the 3.13.0 in the store.

What decompiling does not prove

I should say what this exercise cannot do, since the whole point is not to oversell. Reading the source shows what the code does. It cannot show you what the operating system's own services do with the text after the keyboard commits it to a field, and it cannot show what a recogniser service does with audio on Android 10 and 11. Those are documented on the voice typing page and are the system's behaviour, not this app's.

It also does not make FrankenKeys open source. Unobfuscated means you can read the shipped build. Open source would mean you could rebuild it from a licence-granted source tree. Those are different claims, and the keyboards that make the second one are named honestly in the comparison post.

Somebody read it. That was the line in the Play description and it was not a joke. If you find something in there that contradicts a sentence on this site, the address is corey@forgedev.studio and the fix ships in the next build.