Android Keystore API vs a Signing Keystore: Two Different Systems

Compare their responsibilities

An APK cannot retrieve the private production signing key from its embedded certificate. Likewise, creating a device-side Keystore alias does not create a key that can sign the next Play release. Keystore system, app signing.

Use runtime Keystore for a defined security purpose

Typical uses include generating a non-exportable encryption or signing key and applying authorization restrictions appropriate to the feature. The app can request cryptographic operations without receiving raw private-key material in the usual way.

That protection does not automatically secure every byte of application data. You still need a suitable encryption mode, correct nonce/IV handling, safe storage of ciphertext and a policy for authentication or key invalidation.

Design the data lifecycle before writing code

Decide what happens when the app is reinstalled, the device is restored, a user changes authentication settings or a key becomes unavailable. A secure key that cannot decrypt restored ciphertext requires an intentional recovery path—not a crash or silent data loss.

For account-backed data, reauthentication or resynchronization may be more appropriate than retaining a reusable password locally. Do not add encryption as a substitute for questioning whether the secret needs to be stored at all.

Avoid outdated abstraction assumptions

Android's current cryptography guidance notes the deprecation of the Jetpack security-crypto APIs. Do not copy an old EncryptedSharedPreferences example and label it the default current recommendation without evaluating the migration and platform requirements.

Prefer supported platform primitives and a design reviewed for the application's threat model. A few lines of encryption code are not a complete secure-storage implementation.

Inspect the right evidence

An APK signing-certificate viewer can identify the package's public signing metadata, not the security level of runtime-generated Keystore keys. Runtime key properties need to be checked on the actual device. APKLint can help review code or sensitive API usage, but it cannot certify hardware-backed key storage from a static certificate report.