Signing identity

APK signing certificate SHA-256 fingerprint

The fingerprint is a public digest of the signing certificate. It is safe to use for identity matching, while the keystore and private key must remain protected.

Guide summary

Extract and normalize the SHA-256 fingerprint used to sign an Android release without exposing a private key.

For: Developers comparing local, CI and store-managed signing identities.

Release sequence

  1. Use apksigner verify --print-certs on the exact production APK.
  2. Alternatively use keytool -list -v against a certificate or protected keystore.
  3. Copy the SHA-256 digest and remove separators only if the tool requires it.
  4. Compare Play App Signing and upload certificate fingerprints before assuming they are the same.

Quick facts

Normalized length64 hexadecimal characters
Safe inputPublic certificate fingerprint
Never submitKeystore, password or private key
Field note

This checker accepts fingerprints with or without colon separators and normalizes them before calling the official API.

Detailed guidance

Inspect the artifact users receive

A keystore fingerprint is useful only when that key signs the distributed artifact. With Play App Signing, the upload certificate can differ from the app signing certificate on delivered APKs. For other stores, a channel-specific pipeline may use another production key.

Run apksigner against the exact release APK whenever possible. Normalize the SHA-256 digest by removing colons and spaces before an API request, but preserve the original evidence in release records.

  • Expected normalized value: 64 hexadecimal characters.
  • A certificate fingerprint is public; the private key is not.
  • Never paste a keystore password into a checker.
Android build-tools
apksigner verify --print-certs app-release.apk

Frequently asked questions

Is SHA-1 sufficient?

No. The registration status workflow uses the public certificate SHA-256 fingerprint.

Why does Play show two certificates?

Play App Signing can show both the app signing certificate and a separate upload certificate. The delivered app identity normally uses the app signing certificate.

Sources and review

Last reviewed: