Google recommends an Android signing key valid for at least 25 years, and Google Play requires the key you sign with to have a validity period ending after 22 October 2033. Unlike a website certificate, an Android key must last the app's whole life, because updates have to be signed with the same key.
Why Android keys are long lived
Websites renew certificates every few months because browsers check them often. Android works differently. An update to an installed app must be signed by the same key as the version already on the device. That is how the system knows the update comes from the original publisher.
Google's documentation states the consequence plainly: when a key's validity period expires, users will no longer be able to seamlessly upgrade to new versions of the app. So the expiry date of the key is a hard limit on how long you can ship updates with it.
What Google specifies
The Android signing guide gives three numbers worth knowing.
- Android Studio's key form says the key should be valid for at least 25 years, so you can sign updates through the life of the app.
- For self-managed keys, a validity period of 25 years or more is recommended.
- Google Play has a requirement that the key must have a validity period ending after 22 October 2033.
Check the current guide before you generate a key, since requirements can change.
What this means for your own key
| Situation | What to do |
|---|---|
| Creating a new key for Play App Signing | Give the upload key a long validity anyway, so you do not carry a surprise date |
| Self-managed key made years ago | Check the expiry date now and compare it to 22 October 2033 |
| Key with a short validity | Plan a move to a new key before the date, not after |
If you use Play App Signing, Google holds the app signing key and handles it, which removes most of this worry for the key users see. Your upload key still has a validity period, and a short one will force a reset later.
How to check a key
You can list the validity dates of a key in a keystore with the keytool utility:
keytool -list -v -keystore upload-keystore.jks
Read the valid from and valid until fields. Put the end date in your certificate inventory, next to the owner and storage location.
Rotation as a plan, not a panic
If a key is approaching its end, the platform supports signing with a new key under rules for rotation. A separate post explains how the signature schemes handle that at /resources/blog/apk-signature-schemes-v2-v3-and-key-rotation-explained. Start well before the date, because every user must receive a build that carries the new arrangement.
Why this is not the same as a Windows or Apple certificate
Other platforms handle expiry through timestamps or by checking at install time. Android's rule is about continuity of identity, which is why validity is measured in decades. Do not copy a one year renewal habit from web certificates onto an Android key.
Where Safeguard fits
Key validity decides how long you can update an app. Safeguard helps with what is inside it, through dependency scanning and SBOMs, and has a free scan at gold.safeguard.sh/scan.
Quick check
What happens when an Android signing key expires?
Google says users will no longer be able to seamlessly upgrade to new versions of the app, so update signing becomes a problem.
What validity does Google Play require?
The key must have a validity period ending after 22 October 2033, and Google recommends 25 years or more.
Sources
Last reviewed: 19 October 2026.
