State of Universal Links and App Links 2026: the top 10,000 websites

Name: State of Universal Links and App Links 2026 (v1, Tranco top 10,000)
Creator: Alok Singh
Published: 2026-10-31
License: https://creativecommons.org/licenses/by/4.0/

By Alok Singh · Published October 31, 2026

When you tap a link to a website that has an app, iOS and Android decide whether to open the app or the browser. That decision depends on two small public files: apple-app-site-association (AASA) for iOS Universal Links and assetlinks.json for Android App Links. I build an AASA validator and an assetlinks.json validator, so I wanted to know how the most popular websites actually set these files up. As far as I can find, the last large public measurement of these files was published in 2017 (Liu et al., USENIX Security, mostly about Android).

So on 31 October 2026 I checked the 10,000 most popular domains on the Tranco research ranking. Here is what I found, how I checked it, and how wrong it might be.

Key numbers

21.7% of the top 10,000 domains (2,166) have a valid AASA file on Apple's CDN, the copy iPhones actually download.
17.2% (1,719) serve an assetlinks.json file with at least one statement. This is a lower bound.
15.1% (1,512) have both. 654 have only the iOS file and 207 only the Android one.
Of the AASA files, 45.6% still use only the older paths format, and 47.1% use components (iOS 13 and later).
49.2% of AASA files (1,066) declare webcredentials for Password AutoFill, and 281 declare App Clips.

Share of the Tranco top 10,000 domains (scanned 31 Oct 2026). iOS: valid apple-app-site-association file on Apple's CDN. Android: assetlinks.json with at least one statement (lower bound).

How common are they?

About one in five of the top 10,000 domains has an AASA file on Apple's CDN. That understates adoption by companies: the list counts registrable domains, many of them are APIs, CDNs and ad or tracking hosts with no website at all (1,977 of the 10,000 did not answer an HTTPS request), and I only checked the bare domain and www, not subdomains such as links.example.com. Counting only domains that answered, the share is about 27%.

iOS is ahead of Android: 654 domains have only the iOS file, against 207 with only the Android one. Part of that gap is real and part is measurement: some servers block unknown clients, which hides their assetlinks.json from a scanner but not their AASA file, because the iOS number comes from Apple's CDN rather than the site.

Bigger sites are more likely to have one

Share of domains with an AASA file on Apple's CDN, by Tranco rank band (1,000 / 4,000 / 5,000 domains).

Share of domains serving assetlinks.json with at least one statement, by Tranco rank band (lower bound).

In the top 1,000, 30.1% have an AASA file and 24.1% an assetlinks.json. In ranks 5,001–10,000 it is 19.1% and 15.8%.

What is inside the AASA files

Share of AASA files (Apple CDN copy) containing each feature. A file can have several.

Format. 47.1% of files use the components format and 45.6% use only the older paths array. Both still work. components lets you match the query string and fragment and makes exclusions explicit, so it is the better choice for new files. The universal links guide explains the difference.
More than links. Almost half of the files (49.2%) include webcredentials, which lets an app share saved passwords and passkeys with the website. 16.3% include Handoff and 13.0% App Clips.
Several apps per domain. 61.1% of files list more than one app ID (median 2). Large brands often have separate apps for regions, sellers or companion devices.
Small files. The median file is about 1.1 KB.

On Android, 97.6% of the assetlinks.json files grant handle_all_urls (App Links) and 31.8% grant get_login_creds, the credential-sharing permission that matches webcredentials on iOS.

How I checked

Domains: the Tranco top 10,000 (list 746VX, Le Pochat et al., NDSS 2019). Tranco ranks registrable domains, so example.com and www.example.com are one entry.
iOS: since iOS 14, devices download the AASA file from Apple's CDN (app-site-association.cdn-apple.com), not from the website. I counted a domain when the CDN returned valid JSON for the bare domain or www. I also fetched /.well-known/apple-app-site-association and /apple-app-site-association from the site itself, but I don't publish those numbers (see below).
Android: a direct HTTPS request for /.well-known/assetlinks.json on the bare domain and www, without following redirects (Android doesn't follow them either). A domain counts when the file is a JSON list with at least one statement.
Politeness: one request per file per host, HTTPS only, a 12-second timeout, and a user agent that names this site and the survey. Only public, well-known files were fetched.
Date: 31 October 2026, 13:27–13:54 IST, from one network in India.

How wrong might it be?

I hand-checked a stratified sample of 203 domains from an earlier run of the same scan, re-fetching each file several ways and comparing with Google's Digital Asset Links API.

Check	Sample	Result
AASA found on Apple's CDN: was it real?	50	50 real, 0 false positives (95% upper bound about 6%)
AASA not found on the CDN: was there a valid file anywhere?	25	0 missed (upper bound about 12%)
Format label (components vs paths)	50	50 correct
assetlinks.json found: does Google agree?	25	24 agree, 1 not (4%)
assetlinks.json not found: does Google have one?	25	1 missed (4%), several sites blocked the scanner
A file only on the website, not on Apple's CDN	all 10	at most about 10 domains missed by the CDN view

Checking the website directly turned out to be unreliable. A third of the sites whose AASA file was on Apple's CDN refused or redirected my direct request, and 360 sites answered the AASA address with an ordinary HTML page with status 200. That isn't necessarily a broken setup: 3 of the 25 I checked still had a valid file on Apple's CDN. That is why the iOS numbers here come from the CDN only.

Limits

One snapshot from one network. Some servers block or rate-limit scanners, which lowers the Android count; a repeat run 45 minutes apart moved it by 3.8% and the iOS count by 0.1%.
Only the bare domain and www were checked.
A file being present doesn't prove links open the app: the app also needs the matching entitlement or intent filter. You can try a specific link with the deep link tester.
These are aggregates only. I don't publish per-site results.

Check your own files

AASA validator: structure, rules and a URL tester for apple-app-site-association.
assetlinks.json validator: package names, SHA-256 fingerprints and relations.
Deep link tester: build and test universal links, App Links and custom schemes.
Why universal links open Safari: the hosting and CDN problems behind most failures.

A 100,000-domain version of this study is planned for mid-November 2026.

Data and citation

ulinks-2026.csv: every aggregate above, by rank band, with definitions.
ulinks-2026.json: the same data plus method, validation and limits.

The data is licensed CC BY 4.0. Please cite it as:

Singh, A. (2026). State of Universal Links and App Links 2026 (v1.0.0) [Data set]. bestlatestapps.com. https://doi.org/10.5281/zenodo.23832793

References

Fang Liu, Chun Wang, Andres Pico, Danfeng Yao and Gang Wang, "Measuring the Insecurity of Mobile Deep Links of Android", USENIX Security Symposium, 2017.
Victor Le Pochat et al., "Tranco: A Research-Oriented Top Sites Ranking Hardened Against Manipulation", NDSS 2019. List 746VX, available at tranco-list.eu/list/746VX.

← All guides