How to Get SHA-1 and SHA-256 Fingerprints for Firebase and Google Sign-In

Google Sign-In works perfectly on your machine and fails with a silent error for everyone who installs from Play. Nine times out of ten the cause is the same: you registered your debug or local release fingerprint, but Play re-signed the app with its own key.

Three fingerprints, three purposes

Debug keystore — auto-generated at ~/.android/debug.keystore, password android. Only for local development builds.
Upload keystore — the .jks you created and must never lose. It authenticates uploads to Play, nothing else.
Play App Signing certificate — the key Google uses to sign what users actually download. This is the one production needs.

Reading a keystore fingerprint

The debug keystore, on macOS or Linux:

keytool -list -v -alias androiddebugkey \
  -keystore ~/.android/debug.keystore \
  -storepass android -keypass android

On Windows the path differs:

keytool -list -v -alias androiddebugkey ^
  -keystore "%USERPROFILE%\.android\debug.keystore" ^
  -storepass android -keypass android

For your own release keystore, substitute the real path, alias and password. The output includes SHA1 and SHA256 lines under "Certificate fingerprints".

If keytool is not on your PATH, it ships with the JDK — on a standard Android Studio install, look under the bundled JBR's bin directory. The keystore SHA-1 helper assembles the whole command, including the right path for your OS.

The Gradle alternative

From your project root, with no keytool path hunting:

./gradlew signingReport

This prints fingerprints for every variant and is usually the fastest route.

The production fingerprint you are probably missing

Once Play App Signing is enabled, take the fingerprint from Google, not from your machine:

Play Console → your app → Test and release → Setup → App signing.
Copy the SHA-1 and SHA-256 under App signing key certificate.
Add both to Firebase Console → Project settings → your Android app → Add fingerprint.
Download the refreshed google-services.json and ship it.

Register all of them — debug, upload and Play signing. Firebase accepts multiple fingerprints per app, and having all three means sign-in works in every build variant.

Symptoms of a wrong fingerprint

Google Sign-In returns status code 10 (DEVELOPER_ERROR) — almost always a fingerprint or package-name mismatch.
Sign-in works in debug, fails silently in the Play build.
Maps renders a blank grey grid.
App Links / Digital Asset Links verification fails, so your links open in the browser instead of the app.

Propagation is not always instant — give Firebase a few minutes after adding a fingerprint before concluding it did not work.