The upload key vs app signing key difference comes down to who holds the key and what it signs. You hold the upload key and use it to sign the AAB or APK you send to Play Console. Google holds the app signing key and uses it to sign the APKs that actually install on users’ phones.
Upload key vs app signing key at a glance
An upload key proves to Google that a release came from you, while an app signing key proves to Android devices that an update came from the same publisher as the installed app. Google’s Sign your app guide defines them like this:
- App signing key: “the key that is used to sign APKs that are installed on a user’s device.” It never changes during the lifetime of your app.
- Upload key: the key you use to sign the app bundle or APK before you upload it for app signing with Google Play.
The Play App Signing help page adds the practical details:
| Upload key | App signing key | |
|---|---|---|
| Who holds it | You | Google Play |
| Where it lives | A Java keystore (.jks or .keystore) on your side |
Google’s servers |
| What it signs | Bundles and APKs you upload | APKs delivered to users |
| Key size | RSA 2048 bits or more | Google-generated keys are RSA 4096-bit |
| If you lose it | Request an upload key reset | Without Play App Signing, no more updates |
| Can you download it | It’s already yours | No, Google won’t hand over a copy |
Both keys produce a certificate you can share. Only the private keys must stay secret.
Why Google Play uses two separate keys
Google Play splits signing into two keys so that losing your own key isn’t fatal. The app signing key is the one Android checks on every update, so it has to survive for the life of the app. Keeping it on Google’s side means a stolen laptop or a corrupted keystore can’t take it with them.
Play Console Help is direct about it: “For maximum security, your upload key and app signing key should be different.” If you skip creating a separate upload key, the Android guide says you keep using your app signing key as the upload key for each release. That works, but then the one key that can never change sits on your machine again.
App bundles make this split unavoidable. Google builds the final APKs from your AAB, so Google has to sign them. The Android guide says you need to configure Play App Signing before you upload your app bundle.
What happens when you lose each key
Losing the upload key is a support request, while losing a self-managed app signing key ends updates for that app.
If you lose the upload key, Play Console Help says “you are not locked out of your app.” The reset looks like this:
- Create a new upload key.
- Export its certificate to PEM:
keytool -export -rfc -keystore upload-keystore.jks -alias upload -file upload_certificate.pem - In Play Console, open the Play app signing page (Protected with Play > Play Store protection > Manage Play app signing).
- In the “Upload key certificate” section, click Request upload key reset.
- Enter a reason, upload
upload_certificate.pemand click Request.
Because Google still holds the app signing key, your next release installs as a normal update.
The app signing key is different. For apps that never opted in to Play App Signing, the Android guide says that if you lose the signing key, you lose the ability to update your app. Play Console Help adds that a self-managed key “cannot be reset.” Our post on losing an Android app signing key walks through what’s left to do in that case.
Which key’s fingerprint goes where
API providers check the app signing key’s fingerprint, because that’s the certificate on the APK a user actually runs. Play Console Help says services such as Google Maps, OAuth and Facebook Login authenticate your app with the app signing key’s fingerprint. You must register the Google-held fingerprint, not just your local upload key.
The MD5, SHA-1 and SHA-256 fingerprints of both certificates are listed on the app signing page in Play Console. Here’s where each one belongs:
| Situation | Fingerprint to use |
|---|---|
| Google Sign-In, Maps or Firebase for Play Store installs | App signing key |
assetlinks.json for Android App Links |
App signing key |
| Testing a release build you signed locally before upload | Upload key |
| Debug builds from your IDE | Your debug key |
A real example: Google Sign-In works on your phone when you install the APK you built, then fails for everyone who installs from Play. The usual cause is that only the upload key fingerprint was registered. Add the app signing key fingerprint from Play Console and keep the upload one for local testing.
How the two keys affect APKs you share outside Google Play
APKs you share outside Google Play carry whichever key signed them, and that can split your users into two groups. A copy installed from Play is signed with Google’s app signing key. An APK you signed yourself and sent by email or a download link carries your own key.
Since the signing key never changes over an app’s lifetime, Android treats those certificates as different publishers. A user can’t update a Play install with your self-signed APK. You’d see the kind of failure covered in our post on the APK “App not installed” error.
Play Console Help gives two ways to use one key everywhere:
- Let Google generate the app signing key, then download a signed universal APK from Test and release > Latest releases and bundles, on the bundle’s Downloads tab.
- Generate your own app signing key and transfer a copy to Google when you set up Play App Signing. For existing apps, Google’s PEPK tool encrypts and uploads the key.
What this means for a browser-built APK or AAB
A browser-based builder signs your files with a key you create in the builder, and on Google Play that key becomes your upload key. On webtoapkfree.com, signing runs in your browser, the private key isn’t uploaded to a build server, and the output is a signed APK and an AAB. Upload that AAB to a new Play app and Google generates the app signing key.
The key is kept as a password-encrypted backup in the browser’s IndexedDB and isn’t synced to other devices. The password needs at least 10 characters. Download the backup and store it outside the browser, because that’s your upload key from now on.
The limitation: the builder can’t import JKS or P12 keystores, only its own encrypted backups. If you lose the backup, you’ll need a new upload key from somewhere else and an upload key reset before your next Play release. The signing and updates guide covers backups and version codes, and our guide to signed vs unsigned APKs explains what the signature does on the phone.
Which setup should you choose?
For most indie developers, the default Google-generated app signing key plus a separate upload key is the right setup. You get a reset path for the key you’re most likely to lose, and Google handles the one that can never change.
My take: only provide your own app signing key if you already ship the same app through another store and need one key everywhere. Otherwise you’re taking back the risk that Play App Signing removes.
Give any key you create a validity of 25 years or more, as Google’s guide recommends. If you later need a stronger app signing key, Play Console lets you request an annual key upgrade for installs on Android 17 (API level 37) or higher. Before your first Play release, our guide to installing an AAB file on your phone helps you test the bundle you’re about to upload.
FAQ
Can the upload key and the app signing key be the same key?
They can, but Google recommends against it. Play Console Help says that for maximum security the two keys should be different, so a leaked upload key never exposes the key your users’ installs depend on.
Which SHA-1 fingerprint do I add to Firebase or Google Maps?
For builds installed from Google Play, add the app signing key fingerprint from the Play app signing page. Keep the upload key fingerprint too if you test builds signed with it.
Can I download my app signing key from Google Play?
No. Google’s docs say that after you configure Play App Signing you cannot retrieve a copy of the app signing key. You can download a Google-signed universal APK instead.
What happens if I lose my upload key?
You’re not locked out. Create a new upload key, export its certificate to PEM, and request an upload key reset in Play Console. Your users and the app signing key are unaffected.