How to use the Deep Link File Generator
- Enter your Apple Team ID, bundle IDs and the URL paths that should open the app.
- Enter your Android package name and the SHA-256 fingerprint of your signing certificate.
- Download both files and upload them to
https://yourdomain/.well-known/— or paste existing files to validate them.
Where to host the files
Both files go in the /.well-known/ folder of every domain that should open your app: https://example.com/.well-known/apple-app-site-association (no file extension) and https://example.com/.well-known/assetlinks.json. They must be served over HTTPS, with no redirects, and with the content type application/json. Apple fetches the AASA file through its CDN when the app is installed, so changes can take a while to reach devices.
Matching paths on iOS
The modern components format matches paths with * (any characters) and ? (one character). Rules are checked in order and the first match wins, so put exclusions ("exclude": true, written as !/path above) before broader rules. Your app also needs the Associated Domains entitlement applinks:example.com.
Android fingerprints
assetlinks.json must list the SHA-256 fingerprint of the certificate that signs the app users install. With Play App Signing that is Google’s app signing key from Play Console, not your upload key — a common reason App Links don’t verify. Add both if you test debug and release builds. The intent filter in your manifest needs android:autoVerify="true".
Tools that pair well with the Deep Link File Generator
- App Icon Generator — Drop one square image and get every icon size your app needs — an Xcode-ready AppIcon.appiconset, Android mipmap folders with adaptive icons, the Play Store icon and web/PWA icons — in a single ZIP.
- security.txt Generator — Fill in a few fields to generate a standards-compliant /.well-known/security.txt that tells researchers how to report security issues to you.
- Robots.txt Generator — Build a correct robots.txt in seconds: choose a preset, add rules per user-agent, block AI training crawlers and list your sitemaps — with live warnings for mistakes that could de-list your site.
- HTTP Header Checker — Fetch any URL and see exactly what the server sends back — status code, redirect chain and every response header, with a plain-English explanation of the ones that matter for SEO, caching and security.