Create an Android Signing Keystore with a Recovery Plan

Decide the key's role

For a new Play app using Play App Signing, review the available app-signing arrangements and keep the upload credential separate where appropriate. For another store or direct APK distribution, understand which key must sign future updates.

Do not create a replacement key for an already published package unless the documented rotation or reset workflow permits it. Android signing guide.

Generate through a controlled toolchain

Android Studio's signed-bundle/APK wizard provides a Create new keystore workflow. A command-line alternative can use keytool; a generic example is:

keytool -genkeypair -v \
  -keystore upload-keystore.jks \
  -alias upload \
  -keyalg RSA -keysize 2048 -validity 10000

This is an illustrative upload-key generation command, not an instruction to replace an existing production key. Check the store's current requirements and your organization's cryptographic standards. Enter passwords through prompts rather than command arguments saved in shell history.

Record public identity and private custody separately

Keep the alias, certificate fingerprints, intended application IDs, creation date and responsible owner in release documentation. Store the private keystore and passwords in approved restricted systems, not in that public ledger.

A certificate's subject fields are descriptive. They do not establish that a package came from the organization named in the text, and they are not substitutes for comparing trusted fingerprints.

Test the recovery procedure before the first emergency

Create an encrypted backup and verify that an authorized recovery operator can restore it and inspect the expected alias. Protect backup access separately from ordinary build access where feasible.

A backup that has never been tested may contain the wrong file, an outdated password or only the public certificate. Exporting a certificate is not a backup of the private signing key.

Integrate with the release pipeline

Configure the exact release variant to use the intended credential, build a test artifact and independently verify its signature. Record whether Firebase, API restrictions or other services need the upload, local-release or Play app-signing fingerprints.

APKLint can inspect the resulting APK's public signing metadata. Never upload the keystore itself for an APK check. The analysis tool does not need your private key or password to show the certificate embedded in a signed package.