1.7M distinct code repositories with legible, authored code in all. The container totals are exact; the authored share is sampled. How we know →
Counted the usual way, by line, the corpus is 482B lines across 4.7B files, but that total is bulk, mostly vendored library copies and mechanically decompiled app code, with only a sliver of original source uploaded as-is (the split is below). Counting distinct authored repositories, not raw lines, is the measure that matters.
Overview
The three kinds of code:
Vendored (258B, 54%). Third-party libraries copied into projects. In decompiled apps, these are bundled SDKs; in
archive source, the same files copied across thousands of projects (openssl appears in 6,394, imgui in 4,129, plus game and Unity
SDKs). Measured by library package name and by cross-repo recurrence.
Decompiled app code (213B, 44%). Apps' own logic recovered from APK bytecode by jadx. Readable, structured
code; about a third has names stripped by an obfuscator, though the logic stays intact.
Raw authored source (10B, 2%). Original human-written source unique to one project.
Dedup keeps repo structure. We drop exact re-uploaded archives but keep a library copied into many projects, since it is
part of each project's tree. The tiers are in How we count, below.
What is actually novel. The vendored majority is public open-source, already on GitHub and in training sets. The decompiled app logic, reconstructed from private APK bytecode, is published nowhere, so it plus the sliver of original uploaded source is the only genuinely new code.
Figure 1. How the 482B lines distribute, from how they arrived (decompiled from APKs, or extracted
from archives) to what kind of code they are. More than half is vendored library copies; only a sliver is original authored source.
click a band to browse those real files →
Reading the numbers.Counted figures, container totals (633k archives, 2.1M apps), file counts, and repository counts, are exact over the whole catalog. Sampled figures, lines of code, vendored share, and authored share, are measured on the 2% random sample. Table columns are tagged accordingly.
1By language
Java dominates because it is decompiled from nearly every Android app. The rest comes from uploaded source archives and is
diverse: PHP has the most files (30M small web files), Shell has few files but long build scripts. Figure 2 shows the
archive-source languages by lines; Table 1 gives the exact counts.
Table 1. Per language: files, lines, and the share that is
vendored (the same file copied across many projects). Java's vendored share is bundled SDKs; C/C++ is copied headers.
Table 2. Source repositories by primary language (uploaded archives: zip, rar, other; each distinct repo assigned its single dominant language). Authored = the repo's code is majority human-authored, not a vendored library dump, measured per repo by cross-repo recurrence on a 2% random sample, applied to the exact totals. Shell is set aside (214k tiny installer/module packages, only 1.5% of code by line). The 1.6M decompiled APKs are the separate second tier, not counted here.
Primary language
Code reposcounted
Authoredsampled
Authored %sampled
JS / TS
71,986
29,010
40%
Python
44,103
25,360
58%
Lua
27,602
15,430
56%
PHP
43,141
15,140
35%
C/C++
39,055
13,360
34%
Java source
13,557
7,270
54%
C#
8,800
6,430
73%
Go · Rust · Ruby · SQL
4,052
2,430
60%
All source repos
252,296
114,430
45%
Loose code files (a single script posted directly, not inside an archive) are excluded: once binaries mislabeled with code extensions are removed (for example .ts video), genuine loose code is under 1% of lines.
2How we count
Counts collapse genuine duplication but keep repo structure. Three tiers:
Gross: every occurrence.
Content-distinct: every identical file collapsed once (the unique-code floor).
Archive-deduped (reported): drop exact re-uploaded archives, keep every file inside a kept project.
The gap between tiers is vendoring. Java runs 148B distinct to 446B kept (androidx/kotlin bundled into
each APK); C/C++ runs 4.3B distinct to 17.7B kept (headers copied into about four times as many projects as unique copies).
3How we know these numbers
The corpus is billions of files, far too many to read in full, so we sample and measure, then check the sample is large enough
that more data would not change the answer. A few checks make the totals trustworthy:
Counts are exact Every count (633k archives, 2.1M apps, the per-language repo totals) is a uniqExact over the whole catalog, never a sample scaled up, so no ×N projection can over-count.
Shares held up The splits that need reading code, language mix and authored-vs-vendored, come from a 2% random sample of 14,000 repos, where a share is a proportion (unbiased under sampling) of the exact totals. Growing that sample from 0.5% to 2% left the headline unmoved (authored total 115k, within 1%) and every major-language rate within 2 points. The headline rests on the big, well-sampled languages; the sparse tails (Rust, Dart) are noisier but each under half a percent of repos, too small to move the total whatever their rate.
Converged Split the sample in half and compare per-language shares: they agree to a total-variation distance of 0.007, and that gap halves each time the data quadruples, so more sampling would not change the shape.
Lines counted Line density comes from real fetched files whose sizes matched the catalog to the byte, and a 0.2% sample of complete repos was pulled in full for the browsable viewers and the download.
Independent check The authored-vs-vendored split is confirmed by a signal it was not built from: authored code sits in one project, library code recurs across thousands of apps.
Every number is measured from the lake catalog, at the archive-deduped tier.