Introduction
In 2014, a study by Carnegie Mellon found that only 4% of Android users actually read the permission screen before installing an app. The remaining 96% tapped “Accept” blindly, granting apps access to their contacts, location, camera, microphone, and SMS without a second thought. Android’s install-time permission model — unchanged since Android 1.0 — was security theatre dressed as user consent.
Android 6.0 Marshmallow was officially released on October 5, 2015.
Marshmallow fixed that. It introduced runtime permissions — apps had to request sensitive permissions individually, at the moment they needed them, with the user granting or denying each one. This was the single most important security change in Android’s history. Marshmallow also brought Doze mode for aggressive standby battery saving, Google Now on Tap for contextual screen search, native fingerprint API, and the USB-C transition. It launched on the Nexus 5X and Nexus 6P — Google’s last Nexus phones — and was arguably the most stable, polished Android release since Jelly Bean.
Quick Facts
| Item | Value |
|---|---|
| Version | Android 6.0 – 6.0.1 |
| Codename | Marshmallow |
| API Level | 23 |
| Release Date | October 5, 2015 |
| Linux Kernel | 3.18 |
| Initial Device | Nexus 5X / Nexus 6P |
| Previous Version | Android 5.0/5.1 Lollipop |
| Next Version | Android 7.0 Nougat |
What’s New
Runtime Permissions
This was the feature. Before Marshmallow, Android’s permission model was install-time-only: apps declared every permission they might ever need in their manifest, and users accepted or rejected the entire list before installing. There was no granularity, no way to deny one permission while granting others, and no way to change your mind later without uninstalling the app.
Marshmallow replaced this with a runtime model inspired by iOS:
- Apps request permissions one at a time, at the moment they’re needed
- Users grant or deny each permission individually
- Permissions can be revoked at any time through Settings
- Apps must handle denial gracefully — no crashing when the camera permission is refused
The technical implementation was backward-compatible. Apps targeting API 22 or lower (pre-Marshmallow) still used the old install-time model. Only apps targeting API 23+ (Marshmallow) triggered runtime permission dialogs. This meant the transition was gradual: as developers updated their apps, more and more permissions became runtime-managed.
Six permission groups were classified as “dangerous” and required runtime prompts: Calendar, Camera, Contacts, Location, Microphone, Phone, Sensors, SMS, and Storage. “Normal” permissions (internet, vibration, wake lock) were automatically granted.
The impact was massive. For the first time, users could install Facebook without granting it access to SMS. Or install a flashlight app without giving it location data. The runtime permission model didn’t eliminate privacy abuse — apps still asked, and users still tapped “Allow” more often than not — but it created choice where there had been none.
Doze Mode
Doze was Marshmallow’s battery optimization: when a device was stationary, unplugged, and screen-off for an extended period, Doze restricted network access, deferred jobs, syncs, and wakelocks. The device entered a deep sleep state, waking only periodically during “maintenance windows” to batch pending work.
Google claimed Doze doubled standby battery life on the Nexus 5 and Nexus 6. Independent testing broadly confirmed this — devices left idle overnight on Marshmallow lost 3–5% battery versus 8–12% on Lollipop.
Doze wasn’t without trade-offs. Apps that relied on background network connectivity (messaging apps, VoIP, email) could experience delayed notifications during Doze periods unless they used Google’s high-priority GCM/FCM push channel. Some apps simply broke. Google refined Doze significantly in Nougat, adding a lighter “light Doze” mode for short idle periods.
Google Now on Tap
Google Now on Tap was Marshmallow’s most conceptually ambitious feature: long-press the home button from any screen, and Google would analyze what was on your screen and provide contextual information. Reading a text about a restaurant? Now on Tap would show Yelp ratings, directions, and OpenTable reservations. Listening to a song name in a chat? It would offer a link to the artist.
It was genuinely impressive when it worked. It also only worked in US English at launch, required Google’s server-side screen analysis (raising significant privacy concerns), and was frequently useless — long-pressing on random screens often returned nothing. Google eventually killed Now on Tap in 2017, replacing it with Google Assistant, which used a similar contextual understanding model for more conversational interactions.
Native Fingerprint API
Marshmallow introduced the FingerprintManager API, standardizing fingerprint authentication across Android. Before Marshmallow, Samsung and other OEMs had their own proprietary fingerprint APIs, and apps had to integrate with each manufacturer’s SDK individually.
The Marshmallow fingerprint API provided a standardized authentication dialog (FingerprintDialog), a unified enrollment flow, and integration with Android Keystore for cryptographic key storage unlocked by fingerprint. This enabled the wave of banking, payment, and authentication apps that now use fingerprint (and later face) biometrics.
The Nexus 5X and 6P both included rear-mounted fingerprint sensors (Nexus Imprint), which were fast and well-placed. Combined with the standardized API, fingerprint authentication on Android went from niche to mainstream within a year.
USB-C Support
Marshmallow added native USB Type-C support, including bidirectional power delivery, DisplayPort Alternate Mode, and USB 3.1 data speeds. Both Nexus 5X and 6P used USB-C ports — the first Nexus devices to abandon micro-USB.
USB-C was a mess in 2015. Cable quality varied wildly, with some non-compliant cables potentially damaging devices (Google engineer Benson Leung became famous for testing and reviewing USB-C cables on Amazon). But Marshmallow’s USB-C support was technically solid, and the connector became the universal Android charging standard within 2–3 years.
User Interface Changes
- App Drawer redesign: The app drawer switched to a vertical-scrolling list with a search bar and a row of “suggested” apps at the top — apps predicted based on usage patterns.
- System UI Tuner: A hidden settings menu accessible by long-pressing the Quick Settings gear icon. It let users customize Quick Settings tiles and the status bar — a power-user feature that Google eventually removed in Android 9 Pie.
- Memory settings: Settings → Memory showed per-app RAM usage over time periods (3, 6, 12, 24 hours). This was helpful for diagnosing misbehaving apps.
- Volume controls: Simplified from Lollipop’s confusing three-slider setup to a single ringer volume slider with an expandable media/alarm panel.
Marshmallow’s UI was evolutionary, not revolutionary. Material Design was now standard, and the focus was on fixing Lollipop’s usability issues rather than adding visual flair.
Performance Improvements
- Doze: The most impactful battery improvement since Project Volta.
- App Standby: A companion to Doze — apps the user hadn’t recently interacted with were deprioritized for network access and background processing.
- ART optimizations: AOT compilation refinements reduced install times and app sizes slightly compared to Lollipop’s ART implementation.
Marshmallow on the Nexus 5X (Snapdragon 808, 2 GB RAM) was responsive but not blistering. The Nexus 6P (Snapdragon 810 v2.1, 3 GB RAM) was faster, though the 810 ran hot — a Qualcomm generation problem, not an Android problem.
Security Improvements
- Runtime permissions: The marquee security feature.
- Verified Boot enhancements: dm-verity was extended and hardened.
- Fingerprint API with Keystore integration: Biometric authentication tied to hardware-backed cryptographic key storage.
- M-PESA mobile payment support: Added for African market financial inclusion.
- SELinux policy refinements: Continued hardening of the SELinux policy across system services.
The combined impact of runtime permissions, verified boot, encryption by default (from Lollipop), and SELinux enforcing mode made Marshmallow the most secure Android version to date. It was also the first version where Android’s security model began to approach iOS parity in meaningful ways.
Developer Features
API Level 23 delivered:
| API | Description |
|---|---|
| Runtime permissions | requestPermissions(), onRequestPermissionsResult(), shouldShowRequestPermissionRationale() |
android.hardware.fingerprint | FingerprintManager with FingerprintDialog |
android.os.PowerManager (Doze) | isDeviceIdleMode(), isIgnoringBatteryOptimizations() |
android.credentials | Smart Lock for Passwords — credential management across apps |
android.media.midi | MIDI over USB and BLE support |
android.net.Network | Direct network selection APIs |
android.app.assist | Assist API for contextual actions (Now on Tap infrastructure) |
| App Links | Verified deep link ownership via assetlinks.json |
| Chrome Custom Tabs | In-app browser tabs using Chrome’s rendering engine |
Chrome Custom Tabs was an underappreciated addition. Instead of launching the full Chrome app for in-app web links, Chrome Custom Tabs opened a lightweight Chrome overlay inside the calling app, with the user’s cookies, saved passwords, and autofill data. This was faster, more secure, and kept users in the app’s context. It replaced WebView-based in-app browsers and became the standard for social media, news, and email apps.
Devices That Shipped With Android 6.0 Marshmallow
- LG Nexus 5X — Google’s budget Nexus. 5.2-inch 1080p IPS, Snapdragon 808, 2 GB RAM, 12.3 MP camera, USB-C, $379 (16 GB). Solid value, but the 808 ran warm and 2 GB RAM limited longevity.
- Huawei Nexus 6P — Google’s premium Nexus. 5.7-inch 1440p AMOLED, Snapdragon 810 v2.1, 3 GB RAM, 12.3 MP camera (same sensor as 5X), USB-C, $499. Widely considered the best Nexus phone — great camera, great build, premium feel.
- Samsung Galaxy S7 / S7 Edge — Launched with 6.0.1. 5.1/5.5-inch 1440p Super AMOLED, Snapdragon 820 / Exynos 8890, 4 GB RAM, 12 MP Dual Pixel camera with f/1.7 aperture. The S7 series was Samsung’s peak — waterproof, microSD slot returned, brilliant camera, refined design. Sold 55 million units.
- LG G5 — The modular phone experiment. Swappable bottom module (“Friends”) for camera grip, DAC, and battery. 5.3-inch 1440p IPS, Snapdragon 820, 4 GB RAM, dual rear cameras (standard + wide-angle). Commercial failure, but the dual-camera setup was ahead of its time.
Comparison With Android 5.1 Lollipop
| Android 5.1 Lollipop | Android 6.0 Marshmallow |
|---|---|
| Install-time permissions | Runtime permissions |
| No native Doze | Doze + App Standby |
| Proprietary fingerprint APIs | Standard FingerprintManager API |
| Google Now swipe | Google Now on Tap (contextual screen search) |
| micro-USB | USB-C support |
| Memory usage opaque | Per-app memory usage over time |
| API Level 22 | API Level 23 |
Marshmallow was what Lollipop should have been: stable, polished, and focused on fundamentals rather than flash. The runtime permissions model redefined Android’s security posture. Doze made Android devices competitive with iPhones on standby battery for the first time. The fingerprint API standardised a feature OEMs had been implementing inconsistently for years.
Legacy and Impact
Runtime permissions reshaped Android’s privacy model. The ability to deny individual permissions — camera to Facebook, contacts to a flashlight app, location to a weather widget — gave users genuine agency over their data for the first time. It wasn’t perfect: apps frequently asked for permissions without context, users still defaulted to “Allow,” and the permission groupings were sometimes too broad. But the install-time-accept-everything model was fundamentally broken, and Marshmallow fixed it.
Doze, refined through Nougat and Oreo, made Android’s standby battery competitive with iOS. Before Doze, Android devices typically lost 8–15% battery overnight. After Doze, 3–5% became the norm. This was a measurable improvement that every Android user noticed.
The Nexus 6P was also the end of an era. It was the last Nexus phone — Google’s Pixel line replaced the Nexus program in 2016 — and it was the best Nexus. The 12.3 MP camera (Sony IMX377, 1.55μm pixels) delivered image quality that rivaled the iPhone 6S and Galaxy S7. For the first time, a Nexus phone had a camera worth talking about.
End of Support
- Google Play Services: Support ending or recently ended (as of 2024).
- Play Store: Marshmallow (API 23) is still widely supported — most apps target API 23+ as a minimum, and Marshmallow remains on a non-trivial number of active devices in developing markets.
- Security patches: Last official security patch was around 2018 for Nexus devices. Samsung and other OEMs provided updates into 2019 for flagships.
Marshmallow devices are in the twilight zone: still functional for basic tasks, still running many modern apps, but without security updates for 5+ years. They’re usable, but not advisable.
Fun Facts
- Why “Marshmallow”? Internally, Android 6.0 was codenamed “Macadamia Nut Cookie” (MNC) before the Marshmallow name was finalized. The Building 44 statue was a marshmallow Android bugdroid on a stick.
- Easter egg: The Marshmallow easter egg was a Flappy Bird clone — like Lollipop’s, but with marshmallows instead of lollipops. Still impossibly difficult.
- Benson Leung’s USB-C crusade: Google engineer Benson Leung tested dozens of USB-C cables on Amazon, documenting which ones complied with USB-C specifications and which ones could damage devices. His reviews became legendary in the Android community and forced manufacturers to improve cable quality.
- Nexus Imprint speed: The Nexus 5X and 6P fingerprint sensors were among the fastest of any phone in 2015, rivaling the iPhone 6S’s Touch ID 2. Only OnePlus’s sensors were faster. The rear placement (index finger naturally resting on the sensor) was also ergonomically superior to Apple’s front-mounted sensor.
- Google Now on Tap’s death: Google killed Now on Tap less than two years after launch, folding its contextual awareness capabilities into Google Assistant. The feature’s ambition — understanding everything on your screen — was ahead of the AI infrastructure available in 2015.
Frequently Asked Questions
What API level is Android 6.0 Marshmallow?
API Level 23.
How do runtime permissions work?
Apps targeting Marshmallow must request sensitive permissions (camera, location, contacts, microphone, etc.) individually at runtime. Users can grant or deny each permission. Permissions can be revoked at any time in Settings → Apps → Permissions.
Did Doze really double battery life?
On standby, yes. Google’s claim of doubled standby time was roughly accurate: devices left idle overnight lost 3–5% on Marshmallow versus 8–12% on Lollipop. Active-use battery life was not significantly affected.
Was the Nexus 6P the best Nexus?
Most reviewers and users consider it so. Excellent camera, premium build (aluminum unibody), stock Android with fast updates, and USB-C at a time when Apple was still on Lightning. The Snapdragon 810 ran warm, but the 6P was otherwise near-perfect.
What happened to Google Now on Tap?
It was replaced by Google Assistant in 2017. Assistant used the same screen-context understanding technology for more conversational, interactive responses rather than just information cards.
Final Thoughts
Marshmallow was the “fix everything Lollipop broke” release — and it succeeded. Runtime permissions gave users privacy control. Doze gave users battery life they could count on. The fingerprint API standardized biometric authentication. The app drawer, volume controls, and memory settings refined the rougher edges of Lollipop’s Material Design overhaul.
It wasn’t flashy. Material Design was established, no new UI language debuted, and the feature list was shorter than Lollipop’s. But Marshmallow was the first Android version in years where the launch-day software was genuinely stable, the headliner features worked as advertised, and the Nexus hardware was competitive with the best iOS and Samsung alternatives.
Marshmallow proved that Google could do mature, polished software — not just ambitious experiments. That lesson informed every Android release since.
Related Articles
- Android Version History (2008–Present)
- Android 5.0-5.1 Lollipop: Complete Guide
- Android 7.0 Nougat: Complete Guide
- Runtime Permissions: How Android’s Privacy Model Changed
- The Nexus 6P: A Farewell to Nexus
- Doze Mode: A Technical Deep Dive
References
- Official Android 6.0 Platform Highlights (developer.android.com)
- Android Developers Blog: “Android 6.0 Marshmallow SDK and Final Developer Preview” (August 2015)
- Google I/O 2015, runtime permissions and Doze technical sessions
- LG Nexus 5X and Huawei Nexus 6P product documentation
- “Android Permissions: User Attention, Comprehension, and Behavior” (Carnegie Mellon University, 2014)
- Benson Leung USB-C cable testing documentation
- Samsung Galaxy S7 / S7 Edge product specifications