Android app signing explained

Why apps are signed

A signature ties an app to a private key. Android checks it at install time and on every update: an update is accepted only if it is signed with the same key as the installed app. This stops anyone else from replacing your app with a lookalike.

Keystores, aliases and passwords

Keys live in a keystore file (.jks or .keystore) protected by a password. Inside it, each key has an alias and its own password. To sign an app you need all four: the file, the store password, the alias and the key password. Store them in a password manager and keep an offline backup.

Certificate fingerprints

Each key has a public certificate, identified by its SHA-1 and SHA-256 fingerprints — hashes that look like AB:CD:12:…. Services ask for them to verify your app:

• Android App Links use the SHA-256 in assetlinks.json — build it with the assetlinks.json generator.
• Google Sign-In / Firebase ask for SHA-1 and SHA-256.
• Facebook Login wants a Base64 "key hash" of the SHA-1 — convert it with the key hash converter.

Upload key vs app signing key

Because users receive apps signed with the app signing key, use that key's fingerprints (from Play Console → App integrity) for App Links and sign-in services once your app is on Play.

Signing with APK Maker

Free builds are signed for you so they install anywhere. Pro builds use your own key, generated or uploaded, so you can update the same app — on Google Play or by direct install — for as long as you keep it.

If you lose a key

For apps outside Play, a lost key means users must uninstall and install a new app. On Play, a lost upload key can be reset, but a lost key for an app not using Play App Signing cannot be recovered. Back up keys before you publish.

Create a release key with keytool

If you sign apps yourself, keytool comes with every Java JDK:

keytool -genkeypair -v \
  -keystore my-release.jks \
  -alias upload \
  -keyalg RSA -keysize 2048 \
  -validity 10000

It asks for passwords and a name. A validity of 10,000 days (about 27 years) covers the life of the app — Google Play requires keys valid until well into the future.

To read the fingerprints later:

keytool -list -v -keystore my-release.jks -alias upload

Back up your key properly

• Keep the .jks file in two places — for example an encrypted cloud drive and an offline USB drive.
• Store the store password, alias and key password in a password manager.
• Never commit the keystore to a public Git repository.
• Write down which apps (package names) each key signs.

Signature schemes in one line each

• v1 (JAR signing): the original scheme, checked file by file; needed only for very old Android versions.
• v2 / v3: sign the whole APK at once; faster installs and key rotation support (v3).
• v4: an extra file that enables incremental installs during development.

Build tools apply the right schemes automatically; you only need to keep the key.