Generate a Signed APK in Android Studio and Verify the Output

Prepare the release inputs

Confirm the application ID and version code, and locate the authorized signing keystore and alias. Do not create a new key for an existing app merely because the old file is inconvenient to find; an unrelated key can break update continuity.

Keep passwords in an approved secret store. Back up the keystore and recovery information separately from a developer's laptop. Android signing documentation.

Use the signed-artifact workflow

In Android Studio, use Build → Generate Signed Bundle / APK, then choose APK. Select the application module, supply the intended keystore and alias, and choose the release variant and output location. Studio labels can vary by version; action search can locate the signed-artifact command.

If the goal is a normal Google Play publishing release, check whether the required output is an AAB instead. Choosing APK simply because it installs locally can be the wrong distribution decision.

Verify the output independently

After the build succeeds, inspect the exact output file:

apksigner verify --verbose --print-certs app-release.apk
apkanalyzer manifest application-id app-release.apk
apkanalyzer manifest version-code app-release.apk

Read verification status and compare the certificate fingerprint with the release record. These commands should target the new output, not an older file with the same name. apksigner reference.

Test the release-specific paths

A minified release can behave differently from debug. Test initialization, authentication, dynamically loaded resources, deep links and integrations bound to the signing certificate. Keep mapping files and native symbols associated with this version code.

Test an update over a representative previous release when appropriate. A clean install does not prove that the new build preserves user data or update identity.

Avoid two common certificate mistakes

The certificate used for a local signed APK may differ from Google's app-signing certificate for store-delivered APKs. Register the correct fingerprints with Firebase or API providers for each distribution path.

A valid signature also does not certify security, quality or Play policy compliance. It confirms the artifact passes signing verification under the tool's rules. APKLint's signing tools can display useful certificate metadata, but cryptographic integrity verification belongs to a signing-aware verifier such as apksigner.