Choose two APK (or AAB) files - for example last month's release and the new build - and see exactly what is different: version code, permissions that were added or removed, the signing key (SHA-1 and SHA-256), activities and services, and which files changed and by how much. Your files stay on your device.
Only if three things hold: the package name is the same, both are signed with the same key, and the new version code is higher than the old one. The tool checks all three and tells you at the top of the result.
Android identifies an app by its package name and its signing key. If the key is different, the system treats the new file as an unrelated app and refuses to update the old one - the old app must be uninstalled first, which also removes its data.
Android shows a permission prompt to the user for dangerous (runtime) permissions such as camera, location, contacts or SMS. A new dangerous permission in an update means users will be asked again, which is worth checking before you release.
A file is "changed" when it has the same name in both APKs but different content (different size or checksum). Code (classes.dex) normally changes in every build; a big change in assets or native libraries usually explains a growth in app size.
You can open both, and the file list and signing certificates are compared. The manifest details (version, permissions) are shown only for APKs, because an AAB keeps its manifest in a different format.
No. Your browser reads only the parts of each file it needs, and the comparison is done on your device.