Android 6.0 Marshmallow API 23 Guide: What to Know

The Evolution of Android Security: Understanding API Level 23 (Android 6.0 Marshmallow)

In the history of mobile operating systems, few software updates have fundamentally reshaped user privacy and developer practices quite like Android 6.0 Marshmallow, universally recognized in the developer ecosystem as API Level 23. Released in late 2015, API 23 might seem like a veteran milestone in the fast-paced world of technology, but its legacy defines the modern smartphone experience.

Before API 23, the Android permissions model was plagued by an all-or-nothing approach that left users vulnerable. Today, API 23 stands as the watershed moment that permanently altered how apps interact with our personal data.

The Pre-Marshmallow Dilemma: The “All-or-Nothing” Trap

To understand why API 23 was revolutionary, you have to look at how Android handled permissions prior to version 6.0 (API levels 22 and lower).

Back then, when a user browsed the Google Play Store and clicked “Install” on an app, a massive wall of text appeared detailing every single permission the app requested—access to the camera, contacts, location, microphone, and storage. The user faced a stark binary choice: accept all of them or don’t install the app at all.

This created major security and privacy concerns:

• The “Blind Trust” Problem: Users rarely read the permission lists because they just wanted the app.
• Over-Privileging: A simple flashlight app might demand access to your contacts and precise location, and users had no way to say “no” to those invasive requests while still keeping the flashlight.
• Malicious Exploits: Bad actors routinely bundled dangerous permissions into harmless-looking utilities, harvesting private data right at the moment of installation.

Enter API 23: The Runtime Permissions Revolution

API Level 23 completely dismantled the legacy install-time permission model and introduced Runtime Permissions.

Instead of forcing users to grant all permissions upfront, API 23 allowed apps to request permissions contextually, right when the user actually tried to use a feature requiring them. For example, if a photo-editing app wanted to use your camera, it couldn’t access it immediately upon installation. Instead, the moment you tapped the “Take Photo” button, a system dialog would pop up asking: “Allow [App Name] to take pictures and record video?”

This shift brought profound changes:

1. Granular Control: Users could finally deny permission for specific features while continuing to use the rest of the app.
2. Revocability: Android introduced a centralized settings menu where users could revoke any app’s permission at any time, even long after installation.
3. Contextual Transparency: Users understood why an app needed a specific resource because the request happened in real-time during an active workflow.

Beyond Permissions: Other Pillars of API 23

While runtime permissions stole the spotlight, API 23 introduced several other critical under-the-hood features that shaped modern Android development:

• Doze Mode and App Standby: Battery life was a major focus of Marshmallow. API 23 introduced Doze Mode, which puts the device into a deep sleep state when it’s left idle, flat on a table, or screen-off, significantly reducing background battery drain. App Standby similarly throttled apps that hadn’t been actively used for a while.
• Native Fingerprint Authentication: API 23 brought standardized, system-level APIs for fingerprint sensors. Before this, manufacturers had to roll out their own fragmented SDKs. Marshmallow made biometric logins uniform, secure, and easily adoptable for banking and password-manager apps.
• Direct Share: Sharing content to specific contacts inside specific apps became streamlined through standard target shortcuts.

The Developer’s Challenge: Backward and Forward Compatibility

For developers, the transition to API Level 23 required a massive rewrite of codebase logic. Apps built for older versions had to be refactored to check whether a permission was already granted (ContextCompat.checkSelfPermission) and explicitly request it via ActivityCompat.requestPermissions if it wasn’t. Failing to handle these states correctly resulted in sudden app crashes (SecurityException or unexpected NullPointerException errors).

Even today, API levels serve as crucial baselines. While modern Android versions have iterated heavily on privacy—adding features like one-time permissions, scoped storage, and granular photo pickers—none of these advanced safety nets would exist without the foundational paradigm shift established back in API 23.

Summary

API Level 23 is far more than just a number in a Gradle build file; it is the bedrock of mobile digital hygiene. By shifting power away from blanket developer demands and placing it firmly back into the hands of the user via runtime permissions, API 6.0 Marshmallow transformed smartphones from potential privacy black holes into secure, user-governed personal devices.