Android developer tools

Keystore and APK fingerprint

Open a keystore, a signed APK or app bundle, or a certificate to see every signing certificate's SHA-1, SHA-256 and MD5 fingerprint, owner and validity.

Runs in your browser. The file is read once in this tab, the file field is cleared straight away, and nothing is uploaded or saved. Private keys are skipped, never decrypted.

Accepts .jks, .keystore, .p12, .pfx, .apk, .aab, .jar, .pem, .crt, .cer, .der and .p7b.

Or paste a PEM certificate

Open a keystore, APK, app bundle or certificate.

    Prefer the command line? keytool, Gradle and apksigner
    # Keystore (any type; asks for the store password)
keytool -list -v -keystore my-release-key.jks -alias upload

# Debug keystore (password: android)
keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android

# Every signing config in an Android project
./gradlew signingReport

# A signed APK (build-tools)
apksigner verify --print-certs app-release.apk

# An app bundle or JAR
keytool -printcert -jarfile app-release.aab

# Base64 SHA-1 key hash for Facebook Login
keytool -exportcert -alias upload -keystore my-release-key.jks | openssl sha1 -binary | openssl base64

# BKS keystore (needs the Bouncy Castle provider jar)
keytool -list -v -keystore store.bks -storetype BKS -providerpath bcprov.jar \
  -provider org.bouncycastle.jce.provider.BouncyCastleProvider

    Runs in your browser. The file is read in this tab and never uploaded or stored; private keys are not decrypted. Free to use, no account. More Android developer tools

    How to get your app's SHA-1 and SHA-256

    1. Open your release keystore (.jks, .keystore, .p12), a signed APK or app bundle, or an exported certificate.
    2. If the keystore was made by Android Studio or a recent JDK it is PKCS#12, even when the name ends in .jks: type the keystore password when asked. Older JKS keystores show their certificates without a password.
    3. Copy the SHA-256 (for App Links, Firebase and Google Sign-In), the SHA-1 (for older Google APIs and Firebase) or the Base64 key hash (for Facebook Login).
    4. Publishing on Google Play? Also copy the app signing key's fingerprints from Play Console, because Play re-signs the APKs users install.
    5. Press Use in assetlinks.json to carry the SHA-256 into the assetlinks.json generator.

    What it reads

    • JKS and JCEKS keystores: every alias, key entries and trusted certificates, and whether the password you typed passes the keystore's integrity check.
    • PKCS#12 keystores (.p12, .pfx and modern .jks): the password-based encryption used by the JDK (AES with PBKDF2), OpenSSL 3 and older OpenSSL or Windows exports (3DES and RC2), with the MAC checked so a wrong password is reported as wrong.
    • APKs: the v1 (JAR), v2, v3 and v3.1 signature schemes, each signer's certificate, the Android versions a v3 signer covers, and the key rotation lineage.
    • App bundles and JARs: the JAR signature in META-INF, which for an .aab is your upload key.
    • Certificates: PEM (including a certificate chain or a file that also holds a key), DER, .cer and PKCS#7 .p7b bundles.
    • BKS (Bouncy Castle) keystores are recognised but not read yet; the command line section shows the keytool command for them.

    Upload key or app signing key?

    With Play App Signing, which Google Play requires for new apps, there are two certificates. You sign your app bundle with the upload key on your computer; Google Play then signs the APKs it delivers with the app signing key it holds. Anything that checks the app on a user's device, such as Android App Links, Google Sign-In, the Maps SDK or Firebase, needs the app signing key's fingerprint, which Play Console shows under Release > Setup > App signing. Registering both fingerprints is common, so that builds you sideload or test locally keep working too.

    The debug keystore that Android Studio creates in ~/.android/debug.keystore has its own certificate, different on every computer, so a fingerprint copied from a colleague's machine won't match your debug builds.

    Fingerprint formats

    • Colon hex, as keytool prints it: AB:CD:…. assetlinks.json needs SHA-256 in exactly this form, in upper case.
    • Plain hex without colons, which the Firebase and Google Cloud consoles also accept.
    • Base64 SHA-1, the key hash Facebook Login asks for: the same 20 bytes as the SHA-1, written in Base64 instead of hex.
    • MD5 is shown for old services that still ask for it.

    Expired and long-lived certificates

    Android doesn't check a signing certificate's validity dates when it installs an app, so an expired certificate still signs valid updates. What matters is that every update is signed with the same key, or with a key rotated through the APK Signature Scheme v3 lineage. Android's documentation says a key for apps on Google Play must stay valid until after 22 October 2033, which is why Android Studio offers 25 years by default.

    Private by design

    Privacy

    This page reads the file with JavaScript in your browser tab. The file is read once, the file field is cleared, and the bytes are kept in memory only while the page waits for a password; Clear or closing the tab drops them. The password is only used to decrypt the certificate part of a PKCS#12 file and is cleared from the field afterwards. This tool's code makes no network request with your file, password or results, and saves nothing in the page address or storage.

    This page also shows Google ads, which can use cookies. Privacy and cookies explains how.

    Link to this tool

    Found it useful? You're welcome to link to it from your README, docs or blog.

    Questions

    How do I get the SHA-1 fingerprint of my Android app?

    Open your keystore or a signed APK on this page, or run keytool -list -v -keystore your-key.jks, or ./gradlew signingReport in your project. If Google Play signs your app, the SHA-1 and SHA-256 that devices see are in Play Console under Release > Setup > App signing.

    Why does it ask for a password for my .jks file?

    Since JDK 9 keytool, and Android Studio, create PKCS#12 keystores by default, whatever the file extension. PKCS#12 encrypts the certificates as well as the keys, so the store password is needed to read them. Classic JKS keystores keep certificates in the clear and open without one.

    What is the difference between the upload key and the app signing key?

    The upload key signs the bundle you send to Google Play. With Play App Signing, Google re-signs the APKs it delivers with the app signing key. Services that check the installed app, like App Links, Google Sign-In and Firebase, need the app signing key's fingerprint.

    How do I get the key hash for Facebook Login?

    It is the SHA-1 fingerprint written in Base64 instead of hex. This page shows it as Key hash (Base64 SHA-1). On the command line, pipe keytool -exportcert into openssl sha1 -binary and openssl base64.

    Is it safe to open my release keystore here?

    The file is read by JavaScript in this tab and isn't uploaded or stored, the file field is cleared at once, and private keys are skipped rather than decrypted. If your policy forbids opening keystores in a browser, use the keytool and apksigner commands shown under the tool instead.

    From the same developer

    More Android developer tools

    All 4 Android developer tools