Android App Signing: Complete Guide
Android app signing uses a cryptographic signing key and certificate to establish the identity of an application and protect the integrity of its APK or app bundle. Unlike Windows code signing, ordinary Android app signing does not normally require a publicly trusted CA-issued code signing certificate.
What is an Android signing certificate?
An Android signing certificate is the public certificate associated with an application's signing key. It contains the public key and identifies the signing identity that Android uses when evaluating an application's signature.
The critical secret is the private signing key. The certificate is public information that helps identify and verify the corresponding key. For ordinary Android app signing, the certificate does not need to be issued by a public Certificate Authority in the same way that a traditional Windows code signing certificate often is.
This difference is important when someone searches for an “Android code signing certificate.” Buying a conventional public code signing certificate is not normally the requirement for signing an Android application.
Android app signing at a glance
The application, signing key, certificate, signed artifact, and Android verification process form one identity chain. The underlying cryptographic model is described by how code signing works.
Android app
The application is built into an APK or another release artifact.
Signing key
The developer or organization controls the private signing key.
Signature + certificate
The artifact is signed and associated with the signer's public certificate.
Signed package
The release contains the signing information required for verification.
Android verifies
Android evaluates integrity, signer identity, and update authorization.
Android signing certificate vs traditional code signing certificate
This distinction is one of the most important parts of the Android signing model.
| Aspect | Android app signing | Traditional public code signing |
|---|---|---|
| Typical artifact | APK or Android application release | EXE, DLL, MSI, and other supported software artifacts |
| Signing key | Controlled by the developer or organization | Controlled by the developer or organization |
| Certificate issuer | Can be developer-generated/self-signed for ordinary app signing | Commonly a public Certificate Authority |
| Public CA trust | Not normally required for the application signing identity | Often part of the publisher trust model |
| Primary identity model | Application signing key and certificate | Publisher identity plus certificate chain and platform trust |
| Main security property | Application integrity and signer continuity | Software integrity and publisher identity/trust |
| Key loss impact | Potentially severe because updates depend on signing identity | Severe for future software signing, with platform-specific recovery options |
Why does Android require app signing?
Integrity
Signing gives Android cryptographic evidence that the application has not been altered outside the rules of its signing scheme and package format.
A modified package may no longer satisfy the expected signature relationship, allowing the platform or tooling to detect the change.
Signer identity and continuity
The signing identity associates an application with its signer. That identity also matters when Android determines whether a new version is authorized to update an already installed application.
This makes signing-key continuity a central Android release-management concern. Code signing trust explains the broader role of signer identity in software distribution.
How Android app signing works
A normal release process moves from source code to a signed artifact and then through distribution and device verification.
Build
Compile and package the application into the intended release artifact.
Access key
Load or access the protected private signing key.
Sign
Create the digital signature using the application's signing identity.
Distribute
Upload or distribute the signed release through the selected channel.
Verify
Android and release tooling evaluate the package signature and signer information.
APK vs AAB: what gets signed?
APK
An APK is an installable Android application package. Release APKs are signed so Android can verify the package's signing information and identity.
APK signing is also the context in which tools such as apksigner are commonly used for signing and verification.
Android App Bundle
An AAB is a publishing format used in distribution workflows such as Google Play. The distribution process can produce APKs for individual devices.
Developers therefore need to distinguish the artifact they build and upload from the APKs ultimately delivered to users.
What is Google Play App Signing?
Google Play App Signing changes where the key used to sign APKs delivered to users is controlled. The developer can upload a release using an upload key, while Google Play manages the app signing key used for distributed APKs in the Play App Signing model.
Build + upload key
App signing key + distribution
This is why an upload key and an app signing key are not necessarily the same key.
Upload key vs app signing key
| Key | Purpose | Why it matters |
|---|---|---|
| Upload key | Authenticates the developer's release upload to Google Play. | Loss can create an upload authentication problem. A replacement process may be available. |
| App signing key | Signs the APKs distributed to users in the Play App Signing model. | It is tied much more directly to the application's distributed signing identity and update continuity. |
The exact recovery and upgrade options depend on the Google Play signing configuration. Do not treat an upload-key incident and an app-signing-key incident as the same problem.
Android Keystore and signing keys
Android signing workflows commonly use a keystore to store and manage key material. A keystore can contain key pairs and associated certificates, while an alias identifies a particular entry.
Signing material
- Key pair
- Private key
- Public key
- Certificate
- Alias
Protection layer
- Keystore storage
- Password or credential protection
- Controlled access
- Secure backups
- CI/CD secret management
Code signing key protection standards address a related concern. Keystore protection and certificate identity are different concerns.
How to generate an Android signing key
The conceptual process is simple, but the security of the resulting key is critical because the application's future release identity may depend on it.
Generate key pair
Create the private and public keys for the signing identity.
Create certificate
Associate the public key with certificate information.
Protect storage
Secure the keystore, alias, passwords, and backups.
Configure build
Connect the release signing configuration to the correct key.
Verify release
Confirm the resulting artifact has the intended signer identity.
Common tools in this workflow include keytool, Android Studio, Gradle, and apksigner. This page focuses on the signing model rather than turning each tool into a separate command reference.
Android apksigner
apksigner is a command-line tool used to sign APKs and verify their signatures. Its value is not simply that it produces a signed file. It can also help determine whether the resulting APK has the expected signing status and scheme information.
Use the result to inspect the actual release artifact rather than assuming that a build succeeded means the intended signing identity was applied. The wider code signature verification process also applies across software formats.
Android APK signature schemes
Android has evolved its APK signing mechanisms over time. The major schemes commonly encountered are v1, v2, v3, and v4.
| Scheme | Broad model | Why it matters |
|---|---|---|
| v1 | JAR-based signing model. | Older compatibility model that signs ZIP/JAR entries. |
| v2 | APK-level integrity model using the APK Signing Block. | Provides stronger coverage of APK contents than the older entry-based model. |
| v3 | Builds on APK signing with support for additional signer/key capabilities. | Relevant to modern Android signing and key rotation scenarios. |
| v4 | Designed for a different verification/use case involving incremental installation. | Its role differs from simply replacing v1 with a newer APK signature format. |
The correct scheme combination depends on the Android versions, distribution path, and release requirements being supported. Developers should not assume that one scheme is universally appropriate for every target.
Why APK Signature Scheme v2 and later matter
v1 model
The original model is based around signing ZIP/JAR entries. This can verify signed entries, but it does not provide the same broad APK-level coverage introduced by later schemes.
v2+ model
Later schemes use the APK Signing Block and can verify the APK more broadly. This gives Android a stronger mechanism for detecting changes to the package as a whole.
How Android verifies an APK
Signature scheme
Determine which APK signing mechanism is present and applicable.
Signing certificate
Inspect the certificate associated with the signer.
Public key
Use the public key to validate the corresponding signature.
APK integrity
Determine whether the signed package contents satisfy the signature scheme.
Signer identity
Identify the signing identity represented by the package.
Installed app compatibility
Compare the release with the identity of an existing installation when relevant.
Update authorization
Determine whether the new package satisfies Android's signer/update rules.
Core difference from Windows: Android app signing trust is primarily based on the application's signing identity and continuity, not on a public CA trust chain.
Android app updates and signing identity
Signing is not only about protecting a single APK. It is also part of the application's long-term identity.
If a release is signed with an unrelated identity, Android can treat it as a different signing identity rather than as an authorized update to the installed application. This is why signing-key management must be planned before production distribution.
What happens if you lose the Android signing key?
Key loss and upload-credential loss are not the same event. The impact depends on which key is lost and whether Google Play App Signing is being used.
| Lost credential | Potential consequence | Key question |
|---|---|---|
| Upload key | Release upload authentication can fail. | Is the application using Google Play App Signing, and can the upload credential be replaced through the supported process? |
| App signing key | Potentially much more serious because the key is tied to the distributed application signing identity. | What signing-key management and recovery options apply to the application's current Play configuration? |
For applications distributed outside Google Play, the consequences also depend on how the application is distributed and what signing identity the update mechanism expects.
What happens if an Android signing key is compromised?
Compromise is different from simple loss because an unauthorized party may have access to the secret key. That can potentially allow creation of packages that cryptographically identify with the same signing identity.
Contain
Stop unauthorized use and determine whether the key is still exposed.
Scope
Identify affected applications, releases, build systems, and credentials.
Recover
Use the applicable Android or Google Play key-management and recovery mechanisms.
Reconfigure
Update protected signing infrastructure and authorized release processes.
Investigate
Review potentially unauthorized builds and signing activity.
A compromised signing key can undermine release integrity; the code signing private key compromise scenario explains the wider risks.
Does an Android signing certificate expire?
Android's application signing model should not be interpreted through the same expiration model used for conventional publicly trusted code signing certificates.
The central operational concern is generally the signing key and application signing identity, rather than simply whether a public certificate has reached an expiration date. Developers still need to manage certificate metadata and signing configurations correctly, but “certificate renewal” is not normally the main Android app-signing lifecycle operation.
Android signing certificate renewal vs key rotation
Certificate renewal
A conventional certificate lifecycle operation in which a certificate is replaced or reissued while the underlying identity and intended purpose remain part of a certificate-management process.
Key rotation or upgrade
A change involving signing key material and potentially the application's signing identity. Android and Google Play provide platform-specific mechanisms for supported key upgrades and rotation scenarios.
Do not use these terms interchangeably. An Android key-management event can have update and distribution consequences that are very different from renewing a conventional CA-issued software certificate.
Android key rotation and upgrade
Key changes may become necessary because of a security incident, cryptographic migration, organizational change, or a supported platform key-upgrade process. The exact mechanism depends on the application's distribution model.
Key rotation, certificate renewal, and compromise recovery are three different operational events. A production Android team should document which event it is handling before changing signing configuration.
Android app signing with Google Play
Developer
Build the release artifact and prepare the required upload credentials.
Upload
Authenticate the release submission using the upload-key model.
Google Play
Apply the configured Play App Signing workflow.
Distributed APK
Users receive the APK produced for their distribution context.
Android device
The platform verifies the delivered package and signer information.
The key point is that the developer's upload credential and the key used to sign distributed APKs can have different roles.
Android app signing with Gradle
Gradle connects the build process to release signing configuration. A release build can reference a signing configuration that identifies the appropriate keystore and key entry.
Common configuration concepts
- signingConfigs
- Release build type
- Keystore reference
- Key alias
- Protected credentials
What not to do
- Do not commit private signing keys to source control.
- Do not hard-code keystore passwords into public build files.
- Do not give every build agent unrestricted access to production signing material.
Android code signing in CI/CD
Automated Android releases turn signing into a credential-management problem as much as a build problem. The pipeline should be able to produce a repeatable signed artifact without exposing the production signing key to unnecessary systems or people.
Source
Commit enters the controlled release pipeline.
Build + test
Generate and validate the release artifact before signing.
Sign
Access protected signing material only at the required stage.
Verify
Confirm signer identity and signature status on the final artifact.
Upload
Send the verified release through the configured distribution workflow.
Pipeline controls
Use secret management, restricted build-agent access, protected keystores, separate upload credentials, audit logs, and hardware-backed or remote signing where the environment warrants it.
Android signing with HSM or hardware-backed keys
Hardware-backed key protection can reduce direct exposure of private signing material. The implementation should match the Android signing workflow and the infrastructure available to the organization.
Release artifact
HSM / hardware-backed / remote signing
The goal is not simply to move a keystore somewhere else. Private key protection should cover access, storage, signing operations, and recovery.
How to verify an Android app signature
Use apksigner
Run verification against the actual release APK and inspect the reported signature schemes and signer information.
Verification result: successful
Inspect the application identity
Review the signing certificate and fingerprints associated with the package. For Play-distributed applications, remember that the distributed signing identity can differ from the developer's upload key.
How to find an Android app's signing certificate
The signing certificate can be inspected from the APK's signing information. Useful fields include the certificate, public key, signer identity, and certificate fingerprints.
| Information | What it represents |
|---|---|
| Certificate | Public certificate associated with the signing identity. |
| SHA-256 fingerprint | A compact digest used to identify the certificate in integrations and configuration. |
| SHA-1 fingerprint | An older fingerprint format that may still appear in legacy integrations. |
| Public key | Public cryptographic key corresponding to the private signing key. |
| Signer identity | The application signing identity represented by the package. |
A fingerprint is not a private key. It is derived from certificate information and can be shared for identification purposes. It cannot be used as a replacement for the protected signing secret.
Android signing certificate fingerprints
Developers commonly encounter SHA-256 and SHA-1 fingerprints when configuring Android integrations. A fingerprint is an identifier for certificate material, not the digital signature itself.
SHA-256
Modern security workflows commonly prefer SHA-256 for certificate fingerprint identification.
It may appear in API, OAuth-related, Firebase, Google service, or application-identity configuration.
SHA-1
SHA-1 fingerprints still appear in older documentation and legacy integrations. Their continued appearance does not make SHA-1 equivalent to a modern cryptographic signing algorithm.
Common Android signing errors
| Failure area | Examples | Typical direction |
|---|---|---|
| Key | Keystore not found, wrong password, alias not found, private key unavailable. | Check the selected keystore, alias, credentials, and build-agent access. |
| Signature | APK signature invalid, package modified, unsupported signing scheme. | Inspect the final artifact with apksigner and confirm the signing configuration. |
| Update | Certificate mismatch, app cannot be updated, different signing identity. | Compare the installed application's signer with the new release. |
| Google Play | Upload key problem, app signing mismatch, release signing configuration issue. | Determine whether the failing credential is the upload key or the app signing key. |
| CI/CD | Missing keystore, unavailable secret, wrong configuration, build agent cannot access key. | Trace secret injection and signing configuration through the pipeline. |
How to troubleshoot Android signing problems
Identify artifact
Determine whether the problem concerns an APK, AAB workflow, or another release artifact.
Identify key
Confirm which signing key and certificate the build actually uses.
Check fingerprint
Compare the resulting certificate fingerprint with the expected identity.
Verify APK
Use apksigner to inspect signature verification and scheme information.
Check update path
Determine whether the problem is installation, update continuity, or Google Play upload.
For Play releases: determine whether Google Play App Signing is involved, then identify whether the failing credential is the upload key or the app signing key.
Android signing security best practices
Protect the identity
- Protect the app signing key.
- Back up signing credentials securely.
- Never commit keystores or passwords to source control.
- Restrict production signing access.
- Document the application's signing identity.
Protect the release process
- Separate upload credentials from app signing credentials.
- Use Google Play App Signing where appropriate.
- Secure CI/CD signing environments.
- Monitor signing-key access.
- Verify release artifacts before distribution.
- Plan for key loss and compromise.
Android signing vs Windows code signing
| Aspect | Android | Windows |
|---|---|---|
| Main signing model | Application signing key and certificate | Microsoft Authenticode |
| Public CA required | Generally no for ordinary app signing | Public CA trust is commonly part of the publisher model |
| Trust model | Application signer identity and continuity | Publisher identity, certificate chain, and platform trust |
| Update continuity | Critical to application identity | Important but governed by a different platform model |
| Main artifact | APK / Android distribution artifacts | EXE, DLL, MSI, and other supported Windows artifacts |
| Primary tools | apksigner, Gradle, Android tooling | SignTool and Windows verification tools |
| Certificate renewal | Not the normal central lifecycle model | Common certificate-management operation |
| Timestamping | Different application-signing model | Common in traditional software signing workflows |
Common misconceptions
Android signing implementation
Use the implementation resources to plan a controlled signing workflow.
FAQ
What is an Android code signing certificate?
It is commonly used to describe the certificate associated with an Android application's signing key. Android ordinary app signing does not normally require a publicly trusted CA-issued code signing certificate.
Does Android require a code signing certificate?
Android applications are signed with an application signing key, with an associated certificate used to represent the public signing identity. The certificate does not normally need public CA trust for ordinary app signing.
Do I need to buy an Android code signing certificate?
Normally no. Android app signing is based on developer-controlled signing keys and certificates rather than the conventional public-CA software certificate model.
How does Android app signing work?
The application is built, signed with a protected private key, packaged with the required signing information, distributed, and then verified by Android and relevant release tooling.
What is an Android signing key?
It is the cryptographic key material used to sign an Android application. The private key is the secret component that must be protected.
What is the difference between an Android certificate and signing key?
The certificate contains public information including the public key and signer identity information. The private signing key is secret and is used to create the signature.
What is an upload key?
In the Google Play App Signing model, the upload key is used to authenticate the developer's release upload to Google Play.
What is an app signing key?
It is the key used to sign APKs distributed to users in the Google Play App Signing model, and it is tied closely to the application's distributed signing identity.
What is Google Play App Signing?
It is a Google Play release model in which Google manages the app signing key used for distributed APKs, while developers can use a separate upload key for release submission.
How do I sign an APK?
Build the APK, configure the appropriate signing key, sign the release artifact with Android signing tooling, and verify the final package before distribution.
How do I verify an APK signature?
Use apksigner verification against the actual APK and inspect the resulting signature and signer information.
What is apksigner?
apksigner is a command-line Android tool used to sign APKs and verify their signatures.
What are APK Signature Schemes v1, v2, v3 and v4?
They are successive Android APK signing mechanisms with different signing and verification models. v1 is the older JAR-based model, while v2 and later introduce broader APK-level signing mechanisms and additional capabilities.
What happens if I lose my Android signing key?
The impact depends on which key was lost and the distribution model. Losing an app signing key can be much more serious than losing an upload key because application update identity depends on signing continuity.
What happens if my Android signing key is compromised?
A compromised private key can potentially be used to create unauthorized packages with the same signing identity. The response should include containment, scope assessment, supported key recovery or replacement, and investigation.
Can an Android signing key be rotated?
Supported key rotation or upgrade mechanisms exist in relevant Android and Google Play workflows. The exact process depends on the application's configuration and distribution model.
Does an Android signing certificate expire?
Android application signing is not centered on the same expiration-driven public certificate trust model used for conventional desktop code signing.
Do I need to renew an Android signing certificate?
Android app signing is not normally handled as a traditional CA certificate-renewal process. Developers primarily manage signing keys, application identity, upload keys, Play App Signing, and supported key upgrades.
What is an Android signing certificate fingerprint?
It is a compact digest used to identify certificate material, often for application or service configuration.
What is the difference between SHA-1 and SHA-256 fingerprints?
They are different digest formats used to identify certificate material. SHA-256 is the modern preferred fingerprint format, while SHA-1 may still appear in legacy integrations.
Why can't I update my Android app after changing the signing key?
The new release may not satisfy Android's signer/update rules for the installed application's signing identity. Compare the installed and new package signing identities.
How does Android signing work in CI/CD?
The pipeline builds and tests the release, accesses protected signing material at the signing stage, verifies the final artifact, and uploads it through the configured distribution workflow. Signing secrets should be tightly controlled.
Related code signing resources
Explore these related topics for platform requirements, release verification, and troubleshooting.
Secure automated releases
Automate signing while keeping production credentials under control.
Need help with release signing?
Discuss your signing and release workflow requirements with the team.