Signing an Android app without mixing up your keys

Signing an Android application looks harmless, until the day a lost or mixed-up key blocks every update. Here is what you need to know to avoid it.

Two keys, two roles

• The app signing key is the one that identifies your application to Android. If you enable Play App Signing, Google keeps it and signs the APKs delivered to users.
• The upload key is the one you use to sign what you send to Google Play. Google checks it on upload, then re-signs with the app signing key.

This separation is a safety net: if you lose the upload key, a reset procedure exists with Google. Without Play App Signing, losing the signing key means you can no longer update the application under the same identifier.

Create an upload key

keytool -genkeypair -v \
  -keystore upload.jks -alias upload \
  -keyalg RSA -keysize 4096 -validity 10000

-validity 10000 gives roughly 27 years of validity: a key that expires too early is a source of problems. Write down the keystore password, the key password and the alias: without them, the file is useless.

Check a fingerprint

keytool -list -v -keystore upload.jks -alias upload

Compare the SHA-256 fingerprint shown with the one expected by the Google Play console or your build tool: a different fingerprint means a mixed-up key.

The mistakes that cost dearly

1. Committing the keystore to a Git repository: it becomes accessible to anyone with access to the repository.
2. Not backing up the keystore and its passwords in two safe places.
3. Changing the package name after the first publication: it is a different application for the stores.
4. Forgetting to increase versionCode: an update is refused if this number does not increase.
5. Mixing up APK and AAB: Google Play expects an AAB for new applications.

What PWA2APP does

In PWA2APP, you can generate a key (RSA 4096 by default) or import your own. The keystore and its passwords are encrypted with AES-256-GCM envelope encryption, provided only to the signing service for a given job, and every use is logged. The build is run by a service separate from signing: the compilation worker never sees your key.

Revocation destroys the secrets, irreversibly on the PWA2APP side: always keep your own backup of an imported key.

Key takeaways

• Use Play App Signing and keep the upload key safe.
• Back up the keystore and its passwords, never in the code repository.
• Check fingerprints before every upload.