Rename apps, replace icons, and change real system settings with actual Android APIs. Chameleon talks to the framework directly instead of pretending a switch works.
Every control below writes to a real system setting or calls a real framework service.
Give an app a new name and pin it as a launcher shortcut. Works with every app that has a launcher entry.
Seventeen built-in vector icons, applied as pinned shortcuts with custom labels.
Writes all three real animation scales — window, transition and animator — at once.
Manual brightness, auto-brightness off, and a screen timeout you can cycle through.
Silent, vibrate or normal — straight through AudioManager.
Toggles the display tint and colour temperature on devices that support it.
Builds signed shortcuts and asks your launcher to place them where it supports it.
A real tile in the shade. One tap flips the system dark theme for every app that follows it.
Wi-Fi, Bluetooth, battery saver, USB debugging and private DNS read live, honestly labelled.
Export your settings, or revoke this device's key and start clean.
The "check for updates" button reads latest.json, and if something newer exists it offers you the download. You decide. Nothing installs behind your back.
latest.json also carries a min_version. If a release turns out to be broken, raising that number locks the app until it's updated — with an explanation, not a silent brick.
If the manifest can't be reached, the gate fails open. A network problem never blocks you out of your own phone.
Some settings need privileged permissions Android won't hand out. Chameleon says "not permitted" instead of flipping a switch that does nothing.
That error is the installer refusing the file before it ever runs. In order of how often it's actually one of these:
An interrupted download leaves a partial file that no longer parses. Delete it, reconnect, download again. On mobile, check Files → Downloads for a .crdownload leftover.
If the link 404'd, the browser saved the error page instead. A real APK starts with the bytes 50 4B 03 04 ("PK") — a web page starts with <!DOCTYPE.
Google flags unfamiliar sideloaded apps. Tap More details → Install anyway. This is expected for any app not from the Play Store.
Only if an older Chameleon was installed from a different signing key. Fix: uninstall it first. Nothing else is lost — your key is bound to the device ID, not the install.
The SHA-256 of every release is published in the release notes. Compare it before installing if anything looks off.
Install from the file itself, not from a chat app or downloader — those sometimes re-compress the APK and break the signature.
No server-side accounts, no sign-up. Your device proves its own key.
Tap the button in the app, land on the site, subscribe. That's it.
The app hands the page a sig-issuedAt token. It expires in 30 minutes, so a pasted link can't be reused forever.
The Worker checks the signature against your device id and only then returns your key.
The app verifies the same signature locally and stores it with a three-day expiry.
Download the APK and allow installs from your browser.
Open Chameleon — it asks for a key on first launch.
Subscribe, grab the key, paste it back. Time starts counting.
No. It uses documented Android APIs — ShortcutManager for renames and icons, Settings.Global and Settings.System for system values, AudioManager for sound. The only permission it asks for beyond that is write-access to settings, which you grant yourself.
No, and any app claiming otherwise is lying. Android doesn't let one app repaint another's icon. Chameleon creates a launcher shortcut with your label and icon instead — which looks identical in every launcher that honours pins.
The key is deleted from storage automatically and the app returns to the key screen. Subscribing again gives you a fresh three days.
Settings has an "extend +1 day" button. Seven of them, so a key can live up to ten days. Extensions reset with a new key.
No. The key is derived from your device's ANDROID_ID. Paste it on another phone and it won't validate.
Your device id and link token go to the Worker when you ask for a key. That's it. Your settings never leave the phone, and update checks are plain GitHub API reads.