Every Android release build passes through R8, which does two separate jobs: it removes code nothing calls, and it renames what is left to short meaningless names so the result is hard to read. The first is shrinking. The second is obfuscation. FrankenKeys does the first and refuses the second, with one line in its ProGuard rules:
-dontobfuscate
That line is the whole policy. Here is why it is there, and what it does and does not buy.
What "unobfuscated" means in the shipped file
Open the APK in a decompiler and the packages have their real names. studio.forgedev.forgeboard.ime.ForgeInputMethodService is the keyboard service. studio.forgedev.forgeboard.ime.FieldPolicy is the table of what the keyboard may do in each field type. studio.forgedev.forgeboard.clipboard.ClipboardVault is the clipboard. Method names survive, class comments do not (they never make it into bytecode in any build), and string constants like the FORGEBOARD SETUP 1 file header are exactly as written.
Shrinking still runs. Unused classes from the libraries are dropped, unused methods are removed, and resources nothing references are stripped. So the build is not "debug with a release signature". It is a release build whose surviving code keeps its names.
Why
The product claim is that the keyboard cannot send what you type, and the proof offered is the permission list. A permission list is a strong proof of what the app cannot do. It says nothing about what the app does do with what it keeps on the phone: how the clipboard is handled, whether password fields are learned, what a backup contains. Those are code, and code you cannot read is a promise.
So the code is readable. Somebody who doubts the sentence "nothing is learned in password fields" can open FieldPolicy and see the row. Somebody who doubts "clipboard history lives in memory only" can open ClipboardVault and find the one file it writes, which is pinned clips. That is a weaker guarantee than open source and a much stronger one than a privacy policy, and it is the one I could offer honestly.
The step-by-step is in Decompile FrankenKeys yourself.
What it costs
Size. Obfuscated names are shorter, so an unobfuscated DEX is somewhat larger. I have not measured the exact difference for this app and will not guess at a percentage.
Copying. Anyone can read how the sound engine or the press effects work and reimplement them. I have decided I do not mind. The engine is the reason to buy the keyboard, not a secret, and the point of this site is that reading it is encouraged.
Mystery. The Play description puts it as "inconvenient because I would very much like to be mysterious". That is accurate.
What it is not
It is not open source. You can read the shipped build. You cannot rebuild it from source under a licence, redistribute it, or fork it. HeliBoard, FlorisBoard and Urik are open source; FUTO is source-available under its own terms. All four beat FrankenKeys on this and the comparison post says so plainly. Unobfuscated is an honest description, not a synonym.
It is not reproducible. Even with the source, you could not yet produce a byte-identical APK to compare against Play's. That is a property some open-source projects have worked hard for, and I have not.
It is not a substitute for the manifest. Reading code tells you what the code does today. The manifest tells you what the operating system will let it do, and that is the check that survives an update you did not read. Five permissions, none of them network.
The other assertion in the build
The same build file carries the rule that keeps the permission list honest: after the manifest is merged, a task compares the result to an allowlist of exactly five permissions and fails the build on any addition. That task and the -dontobfuscate rule are the two lines the product rests on. One keeps the claim true; the other lets you check it.
Where it lives
app/proguard-rules.pro:-dontobfuscate, plus a keep rule for native methods so JNI registration works.app/build.gradle.kts:isMinifyEnabled = true,isShrinkResources = true, and theassertAirGaptask.- Neither file ships. The APK is the evidence: pull it and look.
Take it apart on the slab and read it. That is not a dare, it is a feature request, and the address for what you find is at the bottom of the page.