ProGuard and R8 Explained

ProGuard was the original Java shrinker and obfuscator. On Android it has been replaced by R8, which reads ProGuard-format rules but does more. It's integrated into the build, and it converts code to DEX while optimising it. You enable it for release builds, and occasionally you have to tell it what not to touch.

What R8 does

Enabling R8

android {
    buildTypes {
        release {
            isMinifyEnabled = true          // shrink + optimize + obfuscate code
            isShrinkResources = true        // remove unused resources (requires minify)
            proguardFiles(
                getDefaultProguardFile("proguard-android-optimize.txt"),
                "proguard-rules.pro",
            )
        }
    }
}

When you need keep rules

Most modern libraries ship their own consumer rules, so you need few custom rules. Typical cases:

• Reflection: classes or members accessed by name.
• Serialization libraries that use reflection, for example Gson models. kotlinx.serialization and Moshi codegen generate code and need far fewer rules.
• JNI: native code calling Java/Kotlin methods by name.
• Classes named in non-manifest XML or strings and loaded dynamically.

# Keep models deserialized reflectively by Gson (fields read by name)
-keep class com.example.api.legacy.model.** { <fields>; }

# Keep a class loaded by name via reflection
-keep class com.example.plugins.PdfExporter { public <init>(); }

# Keep JNI-called methods
-keepclasseswithmembernames class * { native <methods>; }

"Works in debug, crashes in release"

1. Reproduce with a release-like build locally (minified, debuggable off). Or create a staging build type with minify enabled.
2. Read the obfuscated stack trace and decode it with the mapping file (see below).
3. Look for reflection at the crash site: missing class or method, null fields after JSON parsing, or ClassNotFoundException.
4. Add a narrow keep rule or switch to a codegen-based library, then re-test.

Mapping files and readable crashes

Obfuscation renames classes (a.b.c), so crash reports need the mapping file (build/outputs/mapping/release/mapping.txt) to be readable:

• Upload it with each release. Google Play Console and Crashlytics deobfuscate automatically when the mapping is provided (Gradle plugins can upload it).
• Archive mapping files per version. You can't recreate them later.
• Decode traces manually with the retrace tool when needed.

What you gain

Common mistakes

• Never testing a minified build before release.
• Disabling minification to "fix" a crash instead of writing a targeted rule.
• Losing mapping files, so production crashes become unreadable.
• Believing obfuscation protects API keys. It doesn't. See Secure API Keys.

Frequently asked questions

Conclusion

R8 shrinks, optimises and obfuscates release builds by keeping only reachable code. Enable it with resource shrinking, write narrow keep rules only for reflection and JNI, test minified builds before release, and archive and upload mapping files.

Next step: go further with How to Reduce Android App Size.