You go to ship an update and the keystore is gone. Maybe the laptop died, maybe a contractor kept the file, or maybe you have the file but not the password. If your app uses Play App Signing, this is a delay, not a disaster. Google holds the key that users' devices check, so you can make a new upload key, ask Google to register it, and keep updating the same app.
This guide covers which key you actually lost, where to look first, the exact reset steps, the wait, and what to update afterwards. It also covers the one case that really is bad news: losing an app signing key you manage yourself.
Can you recover a lost Google Play upload key?
A lost Google Play upload key cannot be recovered, but it can be replaced. If your app is enrolled in Play App Signing, you create a new upload key and request an upload key reset in Play Console. Your listing, reviews, installs and update path stay the same, because the app signing key is unchanged.
Google's Android Studio guide to signing your app says this directly. With Play App Signing, if you lose your upload key or it is compromised, you can request a reset, and you can keep uploading new versions as updates to the original app. The same page notes that resetting the upload key does not affect the app signing key that Google uses to re-sign APKs for users.
What Google will not do is send you a copy of the old key or its password. A keystore is an encrypted file, and Google never stores its password. So "recovery" here always means one of two things: finding a copy you already have, or replacing the key with a reset.
Which key did you lose: the upload key or the app signing key?
Most developers who lost a key lost the upload key, which is the one in your .jks or .keystore file. The app signing key is held by Google for any app using Play App Signing. Per Google's signing guide, only apps created before August 2021 that never enrolled have a signing key that lives only with the developer, and that case is much harder.
Play App Signing uses two keys, and the difference decides everything that follows:
| Key | Who holds it | What it signs | If it is lost |
|---|---|---|---|
| Upload key | You, in a .jks or .keystore file | The bundle you upload to Play Console | Request an upload key reset |
| App signing key (enrolled app) | Google Play | The APKs that users install | Nothing to lose, Google keeps it |
| App signing key (self-managed, pre-August 2021 app) | You | The APKs you upload and users install | No more updates to that listing |
Google's signing guide states that Play App Signing is required for apps published after August 2021, and is optional only for apps created before then. If you started your app in the last few years and uploaded an .aab file, you are enrolled. Android App Bundles cannot be uploaded without Play App Signing, a point I cover in the Play Console checks before publishing.
How do I check whether my app uses Play App Signing?
To check whether your app uses Play App Signing, open the app in Play Console and go to the Play app signing page under Protected with Play. An enrolled app shows two certificates there: the app signing key certificate and the upload key certificate. If you see both, Google holds your signing key and a reset will work.
Google's signing guide says that page lists the MD5, SHA-1 and SHA-256 fingerprints for each certificate. Copy the upload key's SHA-1 somewhere safe now. You will use it in the next step to test any keystore files you find.
Before you reset: are you sure the key is gone?
Before you reset, spend twenty minutes looking for the old key, because a reset means waiting. Upload keys tend to survive in build configs, CI secrets, build services and old backups. Test each copy you find against the upload key fingerprint in Play Console. A match means you can ship today.
Check these places first:
- Your project's signing config. Google recommends keeping signing details in a
keystore.propertiesfile that Gradle loads. Search old clones and branches for it, and for anystoreFilepath inbuild.gradleorbuild.gradle.kts. - Your Gradle home folder. Many developers put signing values in
~/.gradle/gradle.propertiesinstead of the project. On Windows that isC:\Users\you\.gradle\. - CI secrets. If a GitHub Actions, Bitrise or Codemagic workflow ever built your release, the keystore may be stored there, often as a base64 string. You cannot read a GitHub secret back out, but a workflow that already decodes it can still sign a build.
- Your build service. If Expo built your app, the keystore may be on its servers. Expo's app credentials docs describe downloading it with
eas credentials. - Old machines and backups. Search old drives, cloud backups and email attachments for files ending in .jks or .keystore.
When you find a candidate, list its contents with keytool, which ships with the JDK inside Android Studio:
keytool -list -v -keystore found-file.jksCompare the SHA-1 it prints with the upload key SHA-1 on the Play app signing page. If they match, you have your key. If they do not match, it is a different key, and Play Console will reject bundles signed with it. Developers commonly report an upload error that says the bundle is signed with the wrong key and shows the fingerprint Play expected next to the one it got. That error is a quick way to test a key without guessing.
What if I forgot the keystore password?
If you forgot the keystore password, Google cannot reset or reveal it, and keytool has no recovery option. Look for the password where tools save it: Gradle property files, CI settings, a password manager, or Android Studio's remembered signing passwords. If none of those has it, treat the key as lost and request an upload key reset.
A keystore can hold two passwords: one for the store and one for the key inside it, plus a key alias. Google's signing guide tells you to use the same password for both, but older projects often used different ones. Before you give up, try the store password as the key password, and check the alias. The Android Studio Generate Signed Bundle dialog fills in the alias for a keystore it has seen before, and it offers to remember the passwords too.
Missing any one of the four pieces locks you out: the file, the store password, the alias, or the key password. That is the main lesson for the backup plan at the end of this post.
How do I reset a lost upload key in Play Console?
To reset a lost upload key in Play Console, generate a new upload key, export its certificate as a .pem file, then open Play app signing and click Request upload key reset. You give a reason and upload the .pem file. Google reviews the request and emails you when the new key is registered.
The steps below follow Play Console Help's page on using Play App Signing, which says you are not locked out of your app if you lose the upload key.
- Create a new upload key. In Android Studio, use Build, then Generate Signed Bundle or APK, then Create new. Or use keytool from the command line:
Play Console Help says the upload key must be an RSA key of 2048 bits or more. A validity of 10,000 days is about 27 years, which clears Google's advice of at least 25 years.keytool -genkeypair -v -keystore upload-keystore.jks \ -keyalg RSA -keysize 2048 -validity 10000 -alias upload - Export the certificate as PEM. This file holds only the public certificate, so it is safe to upload:
keytool -export -rfc -keystore upload-keystore.jks \ -alias upload -file upload_certificate.pem - Open the Play app signing page. In Play Console, go to Protected with Play, then Play Store protection, then Manage Play app signing. Older consoles show this under Release, then Setup, then App signing.
- Request the reset. In the Upload key certificate section, click Request upload key reset. Choose or enter the reason, for example that you lost the key.
- Upload the .pem file and submit. Upload
upload_certificate.pemand click Request. - Back up the new keystore now. Do this before you build anything with it. The checklist at the end covers what to save.
Google Help says you need admin permission to set up Play App Signing. If you work under someone else's developer account, ask the account owner or an admin to send the request.
How long does an upload key reset take?
An upload key reset is not instant, and Google's Help pages do not give a processing time. Developers report waits of a day or more, and the approval email gives the exact date from which the new key works. Until then, uploads must still use the old key, so you cannot ship an update in the meantime.
That gap matters if you are resetting because of a bug in production. Plan for a few days with no uploads, and halt any running rollout if the current build is the problem. My posts on staged rollout percentages and how long Google Play app review takes cover both halves of that timeline.
Losing an upload key costs you a few days, not your app. Losing a self-managed app signing key costs you the listing. Find out which one you have before you panic.
What do I need to update after the reset?
After the reset, point every release build at the new keystore: your local signing config, CI secrets and any build service. Users notice nothing, because the app signing key did not change. Also update any API console that registered your upload key's SHA-1, since that fingerprint is now different.
Work through this list once the approval email arrives:
- Gradle signing config. Update
storeFile, the passwords and the alias inkeystore.properties. Keep that file out of version control, as Google's guide recommends. - CI and build services. Replace the stored keystore and passwords in each workflow that signs releases. A stale secret will produce the wrong key error on the next automated upload.
- API providers. Services like Google Sign-In, Firebase and Maps restrict keys by package name and certificate fingerprint. Builds installed from Google Play carry the app signing key, so those entries are fine. But if you registered the upload key's SHA-1 so that release builds you install yourself can sign in, add the new SHA-1.
- App Links. Your
assetlinks.jsonfile should list the app signing key's SHA-256, not the upload key's, so the reset does not touch it. If you did list the upload key there, your links were already broken for users. See why Android App Links open in the browser for the fix.
One more source of confusion: a release build signed with the new upload key can behave differently on your own phone than the Play version does. Most of the time that is a fingerprint mismatch with an API provider, not a code bug. I cover more of these cases in why a release build works locally but fails on Google Play.
What if I lost the app signing key itself?
If you lost an app signing key that you managed yourself, Google cannot recover it, and you can no longer publish updates to that app. Your only path is a new app with a new package name and a new listing. This only applies to apps created before August 2021 that never enrolled in Play App Signing.
Google's signing guide is blunt about this. For apps not enrolled in Play App Signing, losing the app signing key means losing the ability to update the app. Android only installs an update over an existing app when the certificates match. A build signed with a different key must use a different package name, and users install it as a separate app.
If you still have the key for an older self-managed app, enroll it now. Play Console's app signing page lets an existing app upload its current signing key to Google, and you can then register a separate upload key. After that, a lost upload key is a reset request, not the end of the app.
A compromised app signing key is a different problem. Play Console Help describes a separate key upgrade process for that case, with rules that depend on each install's Android version. Read the Play App Signing help page before you start, because the upgrade changes the fingerprints that your API providers have registered.
How do I make sure I never lose an upload key again?
To avoid losing an upload key again, store all four pieces together in a password manager: the keystore file, the store password, the key alias and the key password. Keep a second copy offline, and write the upload key's SHA-1 next to them so you can always confirm which key a file holds.
A short backup checklist:
- The keystore file is saved as an attachment in a password manager, not only on one laptop.
- The store password, key alias and key password are saved in the same entry.
- An offline copy lives on an encrypted drive that is kept away from your main machine.
- The upload key's SHA-1 from Play Console is recorded with the backup.
keystore.propertiesis in.gitignore, and the keystore is never committed.- Anyone who builds releases for you uses a key you hold, or a CI secret you control.
- You test the backup once by running
keytool -list -von the saved copy.
Where IOn Emit fits
Signing happens in your build, so the reset itself is done in Android Studio and Play Console. What comes after it is where IOn Emit helps. It is a Windows desktop app for publishing to Google Play. Once the new key is active, it takes the signed bundle and handles the release: an 8-step pre-flight wizard, all four release tracks with staged rollout control, and one-click publishing. Your first app is free, with unlimited updates.
This post is part of our app publishing guides for indie Android developers.