ASEC File Documentation

Summary

An .asec file is an Android Secure Encrypted Container, the internal wrapper Android used to hold an app you moved to the SD card. It is an encrypted loopback disk image whose key is tied to the specific phone that made it, with MIME type application/octet-stream, so it is unreadable on a PC or any other device. You cannot open, install, or convert an .asec; to get the app back, reinstall its APK. The mechanism is legacy, replaced by Adoptable Storage in Android 6.0.

Technical details

FeatureValue
Full nameAndroid Secure Encrypted Container (apps-on-SD)
File extension.asec
MIME typeapplication/octet-stream
Format typeEncrypted loopback disk image (device-bound key)
DeveloperGoogle (Android Open Source Project)
IntroducedAndroid 2.2 “Froyo” (2010), as part of Apps2SD
Superseded byAdoptable Storage, Android 6.0 “Marshmallow” (2015)
CategorySystem file (not user-openable)
EncryptionTwofish (128-bit) via device-mapper crypt; key held by vold
Mounted byAndroid vold / MountService over a loop device
Inner filesystemFAT or ext4 image holding the app's APK and data
Magic numberNone readable — contents are encrypted, opaque off-device
Open standardPartial — AOSP mechanism, container is device-specific
Location/.android_secure/ on the SD card; mounted at /mnt/asec/
PortableNo — useless on any device except the one that created it
Convertible to APKNo — “asec to apk” tools are scams/malware
Related extensions.apk, .obb, .aab, .xapk, .img
Referencesource.android.com/docs/core/storage

What is an ASEC file?

ASEC stands for Android Secure Encrypted Container. It is an internal Android system format introduced in Android 2.2 “Froyo” in 2010 to support the “move to SD card” feature, also called Apps2SD. When a user moved an installed app to external storage, Android did not simply copy the APK into the open. It created an encrypted .asec container on the card and mounted it like a tiny virtual disk, keeping the app's code inside a protected image rather than as loose readable files.

The single defining fact about an .asec is that it is bound to one device. The encryption key is generated and held by Android's storage daemon and never leaves the phone, so the container is meaningful only to the handset that created it. Copied to a computer or a different phone, an .asec is just an unreadable blob: it cannot be decrypted, opened, mounted, or converted anywhere else. This is not a format you inspect; it is a system artefact you either leave in place or lose.

How the container is built and mounted

Mechanically, an .asec is an encrypted loopback disk image. When Android moves an app to SD, the volume daemon (vold) allocates a container file, sets up a device-mapper crypt mapping over a loop device backed by that file, and formats the decrypted view with an ordinary filesystem (historically FAT, later ext4). The app's APK and its code cache are written into that inner filesystem. At runtime, when the app is needed, vold re-establishes the crypt mapping and mounts the container so the package manager sees a normal directory of app files.

app moved to SD
  → vold creates  /.android_secure/<pkg>.asec   (encrypted image)
  → dm-crypt maps a loop device over the .asec  (Twofish key held by vold)
  → inner FAT/ext4 filesystem holds  base.apk + app data
  → mounted at  /mnt/asec/<pkg>/   for the running app

The cipher used by the classic Apps2SD mechanism is Twofish with a 128-bit key. Because the mapping and the key are supplied by the operating system on demand, the file on the card is opaque at rest. There is no readable header, no magic byte string, and nothing a hex viewer can extract without the device's key. That opacity is the point: it stopped casual copying of paid apps off the card.

Where ASEC files live on the card

Containers sit in a hidden folder named /.android_secure/ at the root of the SD card, one .asec per moved app. When mounted, the decrypted views appear under /mnt/asec/ (older layouts also referenced /mnt/secure/asec). A small stub or link is kept in internal storage so the framework knows the app exists and where to mount it. If you browse an old Android card on a PC, the /.android_secure folder full of .asec files is exactly what you are seeing: the moved apps, sealed.

The app inside is still an ordinary Android application that originally came from an APK. The .asec adds nothing to the app itself; it is only the encrypted on-card wrapper. This is why the honest answer to “how do I get my app out of this file” is simply to reinstall the APK from its normal source.

Why an ASEC cannot become an APK

Search results are full of “asec to apk” converters, and they are all bogus. The container is encrypted with a device-bound key that lives only on the original phone, so off-device there is no way to decrypt the image, mount its filesystem, or read the APK inside. Renaming an .asec to .zip and opening it in 7-Zip yields nothing, because it is not an archive. Any tool or site claiming to extract an installable APK from an .asec is either a scam or malware; there is no legitimate extraction path. If you want the app, download it again from the Play Store or a trusted APK source.

Why moved apps vanish after a card swap

A common way people meet .asec files is by losing them. If you reformat the SD card, swap it into another phone, or reset the original device, the apps that lived in .asec containers stop working. The containers are still there on the card, but the matching decryption key is gone: a new or reformatted card, or a different handset, does not have it. Those moved apps are effectively unrecoverable, and the fix is always to reinstall them fresh. Deleting the /.android_secure folder has the same effect, so on a card you still use, leave those files alone.

Legacy status and Adoptable Storage

ASEC is legacy technology. Android 6.0 “Marshmallow” introduced Adoptable Storage in 2015, a cleaner replacement that formats and encrypts an entire SD card so it acts as an extension of internal storage. Under Adoptable Storage there are no per-app .asec containers; the whole volume is encrypted at the filesystem level instead. Modern phones largely do not use the old Apps2SD scheme, so the people who still encounter .asec files are almost always inspecting a card from an older device or recovering data and wondering what the encrypted blobs are.

References