With Play App Signing, you sign your app bundle with an upload key that you keep, and Google signs the APKs users install with a separate app signing key that Google stores. Losing the upload key is recoverable, because Google can reset it. That is the main reason to prefer this model.
The two keys in plain terms
According to Google's help page, the upload key is stored in a Java keystore you control. It must be an RSA key of at least 2048 bits. Google uses it to verify your identity when you upload, not to sign what reaches devices.
The app signing key is the one devices see. Google stores it in its key management infrastructure and uses it to sign the final APKs. Google-generated keys are RSA 4096 bit, and a key you supply must be at least RSA 2048 bit. The page recommends keeping the two keys different.
Why does the split matter? The key that proves an update is genuine is never on a developer laptop or a build runner. A stolen upload key lets someone attempt uploads, but it is not the key that devices trust.
If you lose the upload key
You are not locked out. The page describes a reset request in the Play Console: create a new upload key, export its certificate in PEM form with keytool -export -rfc, open the Manage Play app signing area, choose Request upload key reset, give a reason and attach the PEM file.
Practical steps for your team:
- Keep the upload keystore in a secrets manager, not a shared drive.
- Record who can reach it and when it was last used.
- Test the reset path in a calm moment, so the first time is not during a release freeze.
Key upgrade
The same page describes an upgrade option for cases where the app signing key is compromised or you want a cryptographically stronger key. It says upgrades happen annually, and that enforcement differs by Android version, with the platform enforcing the latest key on newer releases while older ones rely on Play Protect checks. The page also tells you to register new key fingerprints with API providers after an upgrade. Read the current page before relying on any detail, since this area is changing.
What changes for sideloaded builds
If you also publish an APK on your own site, check which key signed it. A build signed with a different key from the store build will not install as an update over the store version on a device. Say so on your download page, and publish a certificate fingerprint users can compare. Our APK verification walkthrough shows the user side.
A short checklist
- Enroll in Play App Signing and keep upload and signing keys distinct.
- Store the upload keystore with access logging.
- Document the reset procedure and who files it.
- Publish the signing certificate fingerprint for anyone verifying outside the store.
- Register fingerprints with any API that pins your app signature, and update them after a key change.
For the libraries inside your app, Safeguard provides SBOM and dependency scanning and a free scan at https://gold.safeguard.sh/scan.
Quick check
Which key do users' devices trust?
The app signing key, which Google uses to sign the APKs delivered through Play.
Can I recover from a lost upload key?
Per Google's help page, yes. You request an upload key reset in the Play Console with a new certificate in PEM format.
Sources
Last reviewed: 19 October 2026.
