Chameleon
straight answers

Questions, answered

Including the ones where the honest answer is that Android will not let any app do what you would like.

Getting started

How do I get a key?

Tap go to channel. The app hands you off to YouTube and remembers that you left. Come back and it notices, then makes your key on the spot. No copying, no browser, and it works with no internet at all.

You can also do the whole thing on the website if you would rather, but the in-app route is one tap shorter.

How long does a key last?

Three days from the moment it is made. Inside Settings you can extend it by a day, seven times over, so a key can reach ten days.

Extensions reset when you take a new key.

Do I need root?

No. Everything uses documented Android APIs: ShortcutManager for renames and icons, Settings.Global and Settings.System for system values, AudioManager for sound, and UiModeManager for the theme on Android 12 and up.

The only extra permission is write access to settings, which you grant yourself from Android's own screen when you want it.

What Android version do I need?

Android 8.0, which is API 26. That is the floor because adaptive icons and the shortcut pinning the app relies on both need it.

What it can and cannot do

Can it really repaint another app's icon?

No, and any app telling you otherwise is lying.

Android does not let one app draw over another app's icon. What Chameleon does is create a launcher shortcut with your own label and icon, which looks identical in every launcher that honours pins. The difference is invisible day to day, and it is honest about what it is.

Why can it not draw on my lock screen?

Because the lock screen belongs to your launcher and to SystemUI. Android exposes no API for a third-party app to draw there at all.

So the Lock screen tab builds signed shortcuts and asks your launcher to place them where it supports. On launchers that allow it, they appear. On ones that do not, it tells you that instead of failing quietly.

Why does hibernation just open Settings?

Because PackageManager.setHibernated is hidden from the public SDK. No app is allowed to call it, and reflection to it is blocked on modern Android.

Same story for per-app language on other packages, and for battery saver. Rather than ship three switches that quietly do nothing, those buttons open the real system screen where the change can genuinely be made. You are two taps away instead of eight.

A tweak says "not permitted". Is it broken?

Probably not.

Some system settings need privileged permissions that Android does not hand out to ordinary apps. Chameleon says so rather than flipping a switch that appears to work and quietly does not. On the Tweaks screen, tap grant access and see how many of the controls open up.

Where do the shade tiles go?

Pull the notification shade down, tap the edit pencil, and switch on Dark theme and Motion.

Some manufacturers filter out third-party tiles entirely. If neither appears after adding them, that is your device saying no, and nothing in the app can override it.

The key, honestly

How do you know I actually subscribed?

We do not, and we are not going to tell you otherwise.

YouTube offers no way for any app to confirm a subscription. Finding out would mean requesting OAuth access to your Google account, which we do not do. What the app checks is one real thing: that you left for the channel and came back. That is the whole gate, and it is described as the whole gate everywhere it appears.

Why does my key start with four numbers now?

Those digits are a nonce. Before, the key was a straight hash of your device id, which meant renewing gave you the exact same thirteen characters every time.

Now the nonce is part of the key, so every renewal is genuinely a different key. Because the nonce is embedded, the app can still verify a key offline.

Can someone else use my key?

No. It is derived from your device id, so pasted onto another phone it will not validate.

Worth being straight about the edge: the nonce is chosen on your device, so a determined person who reverse-engineers the app could skip the channel step. Nothing is held on a server to stop them. That is a weaker guarantee than we would like, and it is the price of the key working offline.

Troubleshooting

Android says "invalid package". Why?

That is the installer refusing the file before it runs anything. In order of likelihood:

  • Truncated download. Delete the file and download it again, and check for a leftover .crdownload.
  • A web page saved as an APK. A real APK starts with the bytes 50 4B 03 04. A saved error page starts with <!DOCTYPE.
  • Play Protect blocked it. Tap More details, then Install anyway. Expected for anything not from the Play Store.
  • Signature mismatch. Only if an older Chameleon came from a different key. Uninstall it first. Your key is tied to the device, not the install.

Every release notes its SHA-256 so you can compare before installing.

The app keeps crashing on Tweaks

That should not happen any more. It was a real bug: some system settings throw instead of failing quietly, and the old code let the exception escape.

Every write now reports refusal rather than taking the screen down. If it still crashes, the details are in the release notes and the fix is worth reporting.

I get no notifications

Android blocks notifications by default for freshly installed apps on newer versions. Open Chameleon in Settings, Notifications, and allow them.

The Status tab tells you whether they are currently allowed, so you do not have to go hunting.

Can I be forced to update?

Yes, but only deliberately, and it will always tell you why.

Each release can declare a minimum version. If the installed build is older than that, the app asks you to update before continuing. That only happens to fix a genuine fault. If the update manifest cannot be reached, the check fails open, so a bad network never locks you out of your own phone.

Nothing matches that. Try a different word.