Thor is an Android app manager that hides what the launcher will not show

Three privilege back ends decide what Thor can actually do

The design decision that explains almost every behaviour in the app is the privilege model. Thor performs its actions through one of three providers, and the readme names them Root, Shizuku and Dhizuku, and it labels them in the interface as Groot, Rocket and Star-Lord. Those labels are a nicety, and the readme is careful to say they do not prove a provider is currently available. What matters is that the three have genuinely different capabilities. Root can do everything, Shizuku covers most operations without full root, and Dhizuku uses Android's device-owner APIs for ordinary APK replacement, app removal, data clearing, suspension and hide and unhide, but it does not support Fix Store, force-stop, or whole-device cache clearing. Component changes and forced launches require Root or Shizuku running as root, while ordinary exported activities can be opened without privilege at all. So the same button in the app does different things depending on the back end, and a reviewer who reads only the feature list will misjudge what it does on a given device.

Installation and package formats, with the consent rules spelled out

Thor installs APK, APKM, APKS and XAPK packages, including supported OBB expansion assets, through Root, Shizuku, Dhizuku or Android's own installer. There is no install command in the repository, and the readme points to the FOSS APK on GitHub Releases, which it says is reproducible, and to the Play Store, IzzyOnDroid and Indus Appstore listings for other channels. The FOSS build uses the network for the optional Extension Manager, while the Store build also connects to Google Play Billing, which is the practical difference between the two editions if you care about what the app talks to. The consent rules are worth reading closely. Eligible Root and Shizuku installs of older-target APKs require explicit consent unless the separate saved override is enabled, and install-time runtime-permission grants are opt-in. That is a deliberate constraint, because installing an APK that targets an older Android version gains permissions the newer target would have asked for, and the app makes you confirm that case by case rather than waving it through.

App lists are Room-cached, filterable and exportable

The app list is the surface most people will use, and it is a Room-backed cache rather than a live query against the package manager, with search and filters for source, state and permission, split, frozen, suspended and hidden indicators, and a saved list or grid layout. System apps additionally get Universal Android Deboater recommendation filters labelled Recommended, Advanced, Expert, Unsafe and Unknown, and the User and System tabs remember their filter choices separately. There is a long press and a fast scroll with a visible-range bubble on the long lists, and the current list exports to CSV, which is the feature that turns this from a toy into something you can put in a spreadsheet. App Info quick actions can be reordered or hidden, tapping an app icon launches it and a long press opens Android's own app settings. The repository layout backs the caching claim, with a bypass directory and a shizu_store.json at the top level, alongside the usual Gradle files, fastlane configuration and a release-notes directory.

App Ops and per-component control are where the fine-grained work is

Two features go beyond the usual app manager. The App Ops tab uses Root or Shizuku to show the device's operations, with Relevant, Changed and All filters, search, package and UID modes, and a separate reset to the platform default. The details that matter are in the mechanics. Changes are read back before confirmation, so you see the state after the edit rather than trusting the write, and shared-UID edits warn about the apps affected, which is the case where a permission change silently breaks a sibling app. App Ops modes are kept separate from permission grants, because they are different surfaces in Android and conflating them produces bugs. The per-component control opens activities, stops running services, and disables, enables or resets activities, services, receivers and providers, and Thor records its own disables so a Restore all action can put things back for the current Android user. It also helps recover system apps removed for the current user by older versions of Thor itself.

Freezing preserves the APK, and unsafe targets are blocked outright

The Freezer groups apps for freeze, unfreeze, suspend or force-stop, and the implementation differs by provider. Root and Shizuku freeze by disabling, while Dhizuku uses the device-owner hide and unhide API, and both paths retain the APK and the app data rather than uninstalling. There is a default-on fallback in Settings for the case where the device refuses to disable an app, which keeps the data files but may affect accounts, and the Unfreeze action reinstalls the package. That setting survives app updates, which is a small correctness detail that matters. The risk control is the part to notice. Thor blocks Unsafe freeze targets outright and warns for Expert targets, specifically to reduce the risk of boot problems, because a frozen package that the boot process depends on is a device that does not come back. Freeze Profiles group apps for bulk actions, and removing the last profile membership of a frozen app offers a recovery choice rather than leaving the app stuck.

Guardians runs the slow work in two ordered queues

The background work is handled by Guardians, which runs supported work through two Room-backed foreground-service queues. The data queue covers archive backup and restore, single-app export and bulk-share preparation, and the privilege queue covers supported freeze and unfreeze, suspend and unsuspend, per-app cache, and eligible Fix Store and reinstall actions. Each queue processes its own tasks in order, and the Guardians screen shows Running, Queued and Recent tasks with progress, logs, per-app results and explicit cancellation. Two behaviours are stated rather than implied. Accepted tasks can continue after the screen is dismissed, and task history and recovery state remain visible after an interruption. But completion after every reboot, force-stop or lost privilege is not guaranteed, which is the honest admission that a foreground service is a best effort and not a supervisor. Single-app quick sharing and multi-app bundle export use separate direct paths, so they do not queue behind the long jobs.

Backups are encrypted, and a lost passphrase is a lost archive

The Backup and Restore Hub finds APK, APKS and XAPK bundles and encrypted .thorbak archives, and lets you start backups, inspect them, search, share, restore or delete them. The privilege boundary is the same as everywhere else in the app. Root can back up and restore private app data, while non-root Shizuku is limited to APKs and accessible shared storage. Restores authenticate archive contents before applying them, so a tampered archive is rejected rather than installed. The cost of the encryption is the line the documentation is clearest about, and it is the one you cannot work around: backup passphrases cannot be recovered. Exporting is separate from backup, since multi-app Export writes installer bundles and is explicitly not bulk private app-data backup, and bulk install and batch clear data are simply not available. The app can also clear one app's cache with Root, or caches across the device with Root or Shizuku, and offers background restriction and system-app uninstall where the active privilege mode supports them.

Where Thor is the wrong tool

The first wrong case is a device with no Root and no Shizuku, where the interesting half of the feature list simply does not operate and the app reduces to a launcher with extra steps. The second is a managed or work profile device, where device-owner APIs and package installation are restricted by policy rather than by choice, and where an app manager that writes App Ops and disables components will conflict with the profile. The third is a user who wants a store purchase, since the Play Store edition carries Google Play Billing and the FOSS build does not, and the FOSS build reaches the network only for the optional Extension Manager. The fourth is a device on an old Android version, since the Shizuku and Dhizuku paths and the runtime permission model have both moved across releases, and the readme's own compatibility story is tied to a specific permission-grant flow. The fifth is anyone expecting a bulk operation, because batch clear data and batch install are not available, and the batch actions that do exist, freeze, uninstall, force-stop, suspend, cache clearing, sharing and export, are gated by the same privilege level as their single-app equivalents.

Editorial conclusion

Android users who want to install packages the store will not serve, revoke runtime permissions the system screen makes awkward, or freeze the apps that wake the device at night, are the people Thor is for, and the App Ops tab with read-back before confirmation is the part that shows it was written by someone who has fought with Android's permission model. It is the wrong tool for a phone where you have no Root and no Shizuku, since the privileged features simply will not work, and it is the wrong tool if you want a store purchase, because the FOSS build reaches the network only for the optional Extension Manager while the Store build also connects to Google Play Billing. Check three things before you install it: which privilege provider you actually have, since Dhizuku supports device-owner operations such as APK replacement and hide and unhide but not Fix Store, force-stop or whole-device cache clearing, that the FOSS build you download is the one you want, since the Play Store edition carries billing code the open build does not, and that the version you pick is a release rather than a dev build, since the release list interleaves tagged releases with dev builds. The licence is GPL-3.0, the newest release is v1.97.1 from 2026-10-06, and the last push was on 2026-10-19.

Frequently asked questions

Official sources

1. License: GPL-3.0
2. Project website
3. README
4. Releases
5. trinadhthatakula/Thor on GitHub