A signed APK has a digital signature from a certificate the developer holds. Android checks that signature when it installs the app and again on every update. An unsigned APK is the same app package without that signature. Android won’t install it at all, so an unsigned APK is only a step in a build, never something you hand to a phone or a store.
What the signature actually does
The Android docs on signing your app put the rule plainly: every APK must be digitally signed with a certificate before it’s installed on a device or updated. The Android Open Source Project’s page on application signing explains why. The signature identifies the author of the app and lets the author update it later without any extra permission system.
There’s no certificate authority involved. Android uses self-signed certificates, so you generate your own key and nobody has to approve it. What matters is that the key stays the same. When an update arrives, Android compares its certificate with the one on the installed app and only accepts the update if they match.
Side by side:
| Signed APK | Unsigned APK | |
|---|---|---|
| Installs on a phone | Yes | No, the installer rejects it |
| Accepted by Google Play | Yes, if not debug-signed | No |
| Can receive updates | Yes, from the same key | Not applicable |
| Ties the app to an author | Yes | No |
| Typical use | Testing, sideloading, release | An intermediate build output |
Where unsigned APKs come from
Most people meet an unsigned APK the first time they build a release in Android Studio or on a CI server. The build variants guide says Gradle doesn’t sign a release APK or AAB unless you explicitly define a signing configuration for that build.
Debug builds are different. Android Studio gives the debug build type a generic debug keystore, and when you run the app from the IDE it signs it with a debug certificate stored in $HOME/.android/debug.keystore. So a debug APK installs on your phone without you ever thinking about keys, and the release APK from the same project doesn’t.
A concrete case: you build a release, copy the unsigned file to your phone over USB, tap it, and get the generic install failure. Nothing is wrong with the code. The file just has no signature. I wrote up the other causes of that message in why an APK says “App not installed”.
Debug-signed is still signed, but not for release
A debug-signed APK is a signed APK. It installs and it updates over an earlier debug build from the same machine. But the signing docs say the debug certificate is insecure by design, and most app stores, Google Play included, won’t accept apps signed with it. The debug certificate also expires 30 years after it was created.
For a real release you need your own key. Google’s advice is that it should be valid for at least 25 years, and for Google Play the validity has to end after 22 October 2033.
Upload key vs app signing key
If you publish through Google Play there are two keys, and people mix them up:
- The app signing key signs the APKs that land on users’ phones. It never changes for the life of the app and must stay private.
- The upload key signs the bundle or APK you upload. Google checks it to confirm the upload came from you, then re-signs the app with the app signing key.
With Play App Signing, a lost or leaked upload key can be reset in Play Console. Without it, the docs are blunt: lose your app signing key and you lose the ability to update the app, and you can’t regenerate it. You’d have to ship under a new package name, which Android treats as a completely new app.
Signature schemes, briefly
You’ll see “v1”, “v2” and “v3” in signing tools. According to the AOSP page, v1 is based on JAR signing and has been around from the beginning. v2 arrived in Android 7.0 and covers the whole file, so any change after signing breaks the signature. v3 arrived in Android 9.
The apksigner docs warn that changing an APK after signing invalidates the signature, so if you use zipalign, run it before you sign, not after. To check a file, run apksigner verify app.apk. It confirms whether the signature will be accepted on every Android version the APK supports.
How this works in WebToAPK Free
WebToAPK Free gives you a signed APK for installing and testing on a device and an AAB for a store submission. Signing runs in your browser and the private key isn’t uploaded to a build server. You protect the key with a password of at least 10 characters, and a forgotten password can’t be recovered.
The limitation to know: it can’t import an existing JKS or P12 keystore, only its own encrypted key backups. If you already published an app signed with a keystore from Android Studio, you can’t use this tool to sign updates for that same app. The signing and updates guide covers backing up the key so you don’t lose the ability to update.
My take
“Unsigned” isn’t a kind of APK you’d ever want. It’s a half-finished file. The decision that matters is which key signs your app and where you keep a copy. Back the key up somewhere outside your laptop the day you create it. Losing a project file is annoying; losing the signing key ends your ability to update that app.
If you’re turning a site into an app, the steps before signing are in how to convert a website into an Android app. If you’re worried about handing your key to a web tool, read whether online website-to-APK converters are safe. And before you submit, check whether WebView apps get rejected by Google Play.
FAQ
Can I install an unsigned APK on my phone?
No. Android’s package installer rejects APKs that aren’t signed. Sign it first, even with a test key, and then install it.
Is a debug-signed APK the same as a signed APK?
It is signed, so it installs. But the debug certificate is insecure by design, and Google Play and most other stores won’t accept it for publishing.
What happens if I lose the key I signed my APK with?
If Google Play doesn’t hold your app signing key, you can’t publish updates to that app any more, and a lost key can’t be regenerated. You’d have to ship it under a new package name as a new app.
Why does Gradle give me an unsigned release APK?
Gradle doesn’t sign release builds unless you define a signing configuration for them. Debug builds get a generic debug key automatically; release builds don’t.