--- title: Your ‘App’ Could Have Been a Webpage (so I fixed it for... description: A developer was required to install a mobile app to access a travel itinerary and decided to reverse-engineer it instead. Using Android Studio's virtual device... canonical: https://daily.dev/posts/your-app-could-have-been-a-webpage-so-i-fixed-it-for-you--opi87o8tc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Your ‘App’ Could Have Been a Webpage (so I fixed it for you…) | daily.dev og:description: A developer was required to install a mobile app to access a travel itinerary and decided to reverse-engineer it instead. Using Android Studio's virtual device... og:url: https://daily.dev/posts/your-app-could-have-been-a-webpage-so-i-fixed-it-for-you--opi87o8tc og:image: https://api.daily.dev/og/posts/OPI87o8tC.png og:image:alt: Your ‘App’ Could Have Been a Webpage (so I fixed it for you…) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Your ‘App’ Could Have Been a Webpage (so I fixed it for you…) **[Lobsters](https://daily.dev/sources/lobsters)** · 6 min read · 0 upvotes · 1 comments ## Summary A developer was required to install a mobile app to access a travel itinerary and decided to reverse-engineer it instead. Using Android Studio's virtual device manager, rootAVD, Magisk, and HTTP Toolkit to intercept HTTPS traffic, they discovered the app simply fetched JSON from a REST API endpoint. They then wrote a Ruby script on a cron schedule to pull that JSON and generate a static HTML page — stripping out ads and tracking — that is 0.05MB versus the app's 43MB. The post argues that 'app culture' forces users into worse experiences (tracking, ads, limited accessibility) when the underlying content is just HTML delivered over HTTP, and that a webpage would be superior in nearly every way. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do you intercept HTTPS traffic from an Android app that uses certificate pinning? You need to root the Android device so the app is forced to trust a man-in-the-middle proxy's self-signed TLS certificate. Using rootAVD to root an Android Studio virtual device, then running Magisk configured to auto-grant su access, allows a tool like HTTP Toolkit to install a fake VPN and root CA certificate, letting it decrypt and inspect the app's API calls. _Developers reverse-engineering pinned APIs can browse similar deep dives on daily.dev to sharpen the same techniques._ ### Why do companies build a native mobile app instead of just a webpage for simple content like an itinerary? Native apps let companies collect tracking data tied to accounts and show in-app advertisements, capabilities a plain webpage would not easily provide. In one reverse-engineered travel app, the JSON API delivered itinerary data alongside a tracking payload and an 'inspirations' array of ads, while the underlying content was already just HTML-renderable data served over HTTP. _Anyone weighing app-versus-web tradeoffs for a product can find more takes like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@himu** · 0 upvotes > For most `info` only apps, its quite fine to have just an webpage. > > Most apps are only needed for recurring interactions. For example, food delivery, note taking etc. > > Good reverse engineering though. Love the approach. ## Similar posts on daily.dev - [No, I Won't Download Your App. The Web Version is A-OK.](https://daily.dev/posts/no-i-won-t-download-your-app-the-web-version-is-a-ok--8at5ncomu) · Hacker News · 1 upvotes · 1 comments - [AI Scraping in Mobile Apps: How It Works and How to Stop It](https://daily.dev/posts/ai-scraping-in-mobile-apps-how-it-works-and-how-to-stop-it-2jxmqs7fn) · Security Boulevard · 1 upvotes · 0 comments - [How I Built a Native Android App with Almost Zero Kotlin Experience](https://daily.dev/posts/how-i-built-a-native-android-app-with-almost-zero-kotlin-experience-jwjb4dxde) · Ruby Flow · 1 upvotes · 0 comments - [They Prefer the App](https://daily.dev/posts/they-prefer-the-app-coifvvvfa) · Ibrahim Diallo · 17 upvotes · 2 comments - ["iT woRKs BeTter in THe aPp\!\!"](https://daily.dev/posts/it-works-better-in-the-app--wlvi0bcsg) · Terence Eden · 0 upvotes · 0 comments --- Tags: [#webdev](https://daily.dev/tags/webdev), [#android](https://daily.dev/tags/android), [#privacy](https://daily.dev/tags/privacy), [#reverse-engineering](https://daily.dev/tags/reverse-engineering) [View this post on daily.dev](https://daily.dev/posts/your-app-could-have-been-a-webpage-so-i-fixed-it-for-you--opi87o8tc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Your ‘App’ Could Have Been a Webpage (so I fixed it for you…)","url":"https://daily.dev/posts/your-app-could-have-been-a-webpage-so-i-fixed-it-for-you--opi87o8tc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/your-app-could-have-been-a-webpage-so-i-fixed-it-for-you--opi87o8tc"},"datePublished":"2026-07-11T13:20:51.118Z","dateModified":"2026-09-14T07:36:52.867Z","description":"A developer was required to install a mobile app to access a travel itinerary and decided to reverse-engineer it instead. Using Android Studio's virtual device...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/48cac1e1903742c40767d3a89de05b38?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/48cac1e1903742c40767d3a89de05b38?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/your-app-could-have-been-a-webpage-so-i-fixed-it-for-you--opi87o8tc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"webdev,android,privacy,reverse-engineering","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"Your ‘App’ Could Have Been a Webpage (so I fixed it for you…)"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/your-app-could-have-been-a-webpage-so-i-fixed-it-for-you--opi87o8tc","comment":[{"@type":"Comment","text":"For most info only apps, its quite fine to have just an webpage.\nMost apps are only needed for recurring interactions. For example, food delivery, note taking etc.\nGood reverse engineering though. Love the approach.","datePublished":"2026-07-11T13:26:08.798Z","url":"https://daily.dev/posts/OPI87o8tC#c-fB9X2RTbE","author":{"@type":"Person","name":"Himu","url":"https://daily.dev/himu","image":"https://avatars3.githubusercontent.com/u/18563948?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/your-app-could-have-been-a-webpage-so-i-fixed-it-for-you--opi87o8tc#faq","mainEntity":[{"@type":"Question","name":"How do you intercept HTTPS traffic from an Android app that uses certificate pinning?","acceptedAnswer":{"@type":"Answer","text":"You need to root the Android device so the app is forced to trust a man-in-the-middle proxy's self-signed TLS certificate. Using rootAVD to root an Android Studio virtual device, then running Magisk configured to auto-grant su access, allows a tool like HTTP Toolkit to install a fake VPN and root CA certificate, letting it decrypt and inspect the app's API calls. Developers reverse-engineering pinned APIs can browse similar deep dives on daily.dev to sharpen the same techniques."}},{"@type":"Question","name":"Why do companies build a native mobile app instead of just a webpage for simple content like an itinerary?","acceptedAnswer":{"@type":"Answer","text":"Native apps let companies collect tracking data tied to accounts and show in-app advertisements, capabilities a plain webpage would not easily provide. In one reverse-engineered travel app, the JSON API delivered itinerary data alongside a tracking payload and an 'inspirations' array of ads, while the underlying content was already just HTML-renderable data served over HTTP. Anyone weighing app-versus-web tradeoffs for a product can find more takes like this on daily.dev."}}]} ```