If you lose your Android app signing key and Google doesn’t hold a copy, you can’t publish updates to that app ever again. Android only installs an update when its certificate matches the installed version, so your only route is a new app with a new package name. If your app uses Play App Signing, the key you lost is probably just the upload key, and Google can reset it.
What happens when you lose an Android app signing key
When you lose an Android app signing key, existing installs keep working, but you lose the ability to update them. Google’s app signing guide says that for apps not enrolled in Play App Signing, losing the key means you lose the ability to update your app. Google cannot retrieve the key for you.
Android compares the certificates in an update with those in the installed version and only allows the update if they match. A new key with the same alias and password won’t pass: the same guide says you cannot regenerate a previously generated key.
Upload key or app signing key: which one did you lose?
The key you lost decides whether this is a nuisance or the end of the app. Google’s docs define two keys:
- App signing key: signs the APKs that end up on users’ phones. It never changes during the lifetime of your app.
- Upload key: signs the app bundle or APK before you upload it to Play Console.
If you enrolled in Play App Signing, Google holds the app signing key and your local keystore is only the upload key. If you never enrolled, the key on your laptop was the app signing key.
| Your situation | What you lost | Can you still update? |
|---|---|---|
| Google Play app with Play App Signing | Upload key | Yes, after an upload key reset |
| Google Play app signing with your own key | App signing key | No, only a new app with a new package name |
| APK shared outside Google Play | App signing key | No, users must uninstall and install a new app |
To check, open the Play app signing page in Play Console. If it shows an app signing key certificate managed by Google, you’re in the first row.
How to reset a lost upload key in Play Console
With Play App Signing, a lost upload key is fixable. Play Console Help says you are not locked out of your app.
- Create a new upload key in Android Studio, or with keytool as in our guide to signing an APK from the command line.
- Export its certificate to PEM:
keytool -export -rfc -keystore upload-keystore.jks -alias upload -file upload_certificate.pem - In Play Console, open Play app signing (under Protected with Play) > Play Store protection > Manage Play app signing.
- In the Upload key certificate section, click Request upload key reset.
- Enter the reason, upload
upload_certificate.pem, and click Request.
The reset doesn’t touch the app signing key Google uses for users’ devices, so installs keep updating.
What to do if you lost the app signing key itself
If you managed the app signing key yourself and lost it, no request in Play Console brings it back. Play Console Help says the app signing key cannot be reset if you manage it yourself and lose it.
You start over:
- Create a new key, and this time enroll the new app in Play App Signing.
- Change the package name. Google’s guide says a different certificate means a different package name, and users install it as a completely new app.
- Publish the new app, then update the old store listing to point people to it.
Existing users don’t move over. Their copy stays on the old package and never updates again, and reviews and install counts stay behind too.
My take: Play App Signing should be mandatory for any app you plan to keep alive. This is the one Android mistake you can’t fix later, and enrolling turns a lost laptop into a support ticket instead of a relaunch.
What happens to APKs you shared outside Google Play
APKs installed from a website, email or file share have no reset option, because no store holds a copy of your key. A build signed with a new key won’t install over the old one. Android shows an install error, and the user has to uninstall the old app first, which deletes its local data. Our posts on the APK “App not installed” error and signed vs unsigned APKs show what users see.
How a browser-based builder changes the risk
Browser-based app builders move the key from a keystore file into browser storage, which changes how people lose it. On webtoapkfree.com, signing runs in your browser and the key is saved as a password-encrypted backup in the browser’s IndexedDB for that site. It isn’t synced to other devices or browsers.
So clearing site data, switching laptops or reinstalling the browser can wipe the only copy. The builder asks you to download a separate key backup and keep its password safe. The password needs at least 10 characters. Forget it and it’s gone.
The limitation: the builder can’t import JKS or P12 keystores, only its own encrypted backups. Lose that backup and APK and AAB updates for that package stop, because there’s no way to bring in a key from elsewhere. The signing and updates guide covers backups and version codes.
How to avoid losing your signing key
Prevention is cheap compared with relaunching an app. Google’s guide recommends:
- Store the keystore file somewhere secure, with a copy outside your main computer.
- Use a strong password for the keystore and a separate strong one for each private key.
- Give the key a validity period of 25 years or more.
- Keep your upload key and app signing key different, which Play App Signing does for you.
If you later need a stronger key, Play Console lets you upgrade the signing key of a published app. The new key signs installs and updates on Android 13 and higher. Before a Play release, our guide to installing an AAB file on your phone shows how to test the bundle with your real key first.
FAQ
Can Google recover my lost app signing key?
Only if Google already holds it through Play App Signing. If you managed the key yourself, Google’s docs say it cannot retrieve the key for you, and the key cannot be reset.
Can I publish the same app again with a new key?
Not as an update. A new key means a different package name, so the store and the phone treat it as a completely new app with its own installs and reviews.
What if I only lost the upload key?
With Play App Signing you’re not locked out. Create a new upload key, export its certificate to PEM, and request an upload key reset in Play Console.
Can I regenerate the same key with the same password?
No. Google’s signing docs say you cannot regenerate a previously generated key. A new key with the same alias and password is still a different key.