net::ERR_CLEARTEXT_NOT_PERMITTED
The app tried to load a page over plain HTTP, and Android's security policy blocks unencrypted traffic for apps unless they explicitly allow it.
Quick checks
- As a user: update the app; the developer has to fix this.
- As a developer: does the URL start with http://?
Fixes on Mac
For developers testing on a Mac
- Serve your local backend over HTTPS, or allow cleartext only for your dev host (see below).
Fixes on Windows
Same for Windows
- Use HTTPS for the backend or a debug-only network security config.
Other devices
Fix it in the app
- Best: switch the URL to
https://. - For a specific host, add
res/xml/network_security_config.xmlwith a<domain-config cleartextTrafficPermitted="true">for that domain, and reference it from the manifest'sandroid:networkSecurityConfig. - Avoid
android:usesCleartextTraffic="true"for the whole app outside debug builds.
- Best: switch the URL to
Still not working?
Users can't change this policy; only the app's developer can. Report the error to them with the app version.
See what’s happening
LightAtom's connections view shows plain-HTTP connections on port 80 from Mac apps, the same kind of traffic Android blocks.
Frequently asked questions
Why does Android block HTTP?
Since Android 9 (API 28), apps default to blocking cleartext traffic, to protect users from interception. Apps must opt in for specific domains.
How do I allow HTTP for localhost in Android?
Use a network security config with a domain-config allowing cleartext for 10.0.2.2 (the emulator's host) or your dev domain, ideally in debug builds only.
Is usesCleartextTraffic safe?
It allows unencrypted traffic to every domain. Limit it to the hosts that need it with a network security config instead.