Find the standard debug keystore
Android tooling commonly places it under the user's .android directory, such as ~/.android/debug.keystore. On Windows, the corresponding path is under the user's profile directory. A project can override the debug signing configuration, so inspect the build when the default file does not match the installed app. Signing guide.
To inspect the standard certificate locally:
keytool -list -v -keystore "$HOME/.android/debug.keystore" -alias androiddebugkey
Enter android when prompted for the standard store password. Use the correct path syntax for your shell; do not paste a Unix path into an unrelated Windows command prompt unchanged.
Use the fingerprint for the correct environment
A debug SHA-1 or SHA-256 fingerprint may be needed for a development Firebase or API configuration. Another developer's machine can have a different debug certificate. CI may also generate or use its own file.
Record the environment next to each fingerprint. A list of unlabeled certificate hashes becomes difficult to maintain when login works locally but fails on a store-installed release.
Do not delete the file as the first fix
Deleting a debug keystore causes tooling to generate a different certificate. That can invalidate registrations associated with the previous fingerprint and prevent a signed update over an existing debug installation.
Before regenerating, inspect whether the problem is an incorrect path, password, alias or custom signing configuration. For a disposable development app, reinstalling may be acceptable; for a device with valuable test data, plan the consequences first.
Keep release credentials separate
| Debug artifact | Release artifact |
|---|---|
| Public standard password is expected | Strong, privately managed credentials are required |
| Often machine-specific certificate | Stable, documented release identity |
| Suitable for development tests | Used for authorized distribution |
Never “fix” release signing by pointing it at debug.keystore. A convenient build is not a production-ready release.
Verify the built APK when in doubt
The configuration file describes intent; the APK certificate shows the artifact's actual signing identity. Inspect that output and compare it with the expected debug record. APKLint can display signing metadata for an uploaded APK, but it does not recover keystore passwords or confirm that a certificate belongs to a trusted publisher.
Sources and further reading
Reference review: 22 September 2026. Examples illustrate the workflow; check your installed versions, release artifact and account-specific Console requirements before applying them. This guide is not a claim that APKLint executed your project or verified your private account.
Android inspection tools and practical release guides. About APKLint · Report a correction
