Corenna
    Sign in
    Guide · Android · Signing

    Android keystore: keytool command, backup & lost-key fix (2026)

    Nathan Claiborne
    An Android keystore is the long-lived secret that proves your updates come from you. Lose it, and you can't ship an update without renaming the app. This guide covers everything from keytool commands to Play App Signing recovery.

    What's actually inside a keystore

    A .jks or .keystore file is a password-protected container holding one or more key entries. Each key has an alias, its own password, and an X.509 certificate. Android signs the APK/AAB with this private key; the OS only allows updates signed by the same key.

    Generate one with keytool

    keytool -genkey -v \
  -keystore release.keystore \
  -alias release \
  -keyalg RSA \
  -keysize 2048 \
  -validity 10000 \
  -storetype PKCS12

    Use PKCS12 (modern standard) over the legacy JKS format. Validity of 10,000 days (~27 years) is the Play Store recommendation — it must outlive your app.

    Fields that matter (and ones that don't)

    • Keystore password — opens the file. Strong, unique, stored in a password manager.
    • Key password — unlocks the alias. Often the same as the keystore password for simplicity.
    • CN, OU, O — embedded in the cert; visible to power users. Use your real org name.
    • SHA-1 / SHA-256 fingerprint — needed for Google Sign-In, Firebase, Maps API.

    Upload key vs app signing key (Play App Signing)

    With Play App Signing enabled, Google holds the app signing key and you upload artifacts signed by your upload key. If you lose the upload key, you can request a reset from Google and continue shipping. If Play App Signing is not enabled and you lose your single key, you cannot update the app — period. Building an .aab opts you into Play App Signing automatically for new apps.

    Backup and rotation checklist

    • Export the .keystore file and store it in at least two encrypted locations (1Password, encrypted USB).
    • Save passwords and the alias in a password manager — not in the same place as the keystore file.
    • Record the SHA-1 and SHA-256 fingerprints alongside the file.
    • Never commit the keystore to git, even to a private repo.

    How Corenna stores your keystore

    Encrypted at rest with authenticated encryption, passwords stored separately from the file, pushed into your repo's GitHub Actions Secrets via libsodium sealed-box encryption, and decrypted only inside ephemeral runners. You can export and revoke at any time — full details on the Security page.

    Keep reading