The first thing to establish is which key you lost, because the answer is completely different depending on whether you are enrolled in Play App Signing.
Are you on Play App Signing?
Play Console → your app → Test and release → Setup → App signing. If that page shows an App signing key certificate, Google holds the key that signs what users install, and the keystore on your machine is only an upload key.
Every app uploaded as an AAB is enrolled, which is all new apps since August 2021.
If you are enrolled: you can recover
Losing the upload key is inconvenient, not fatal. You request a reset:
- Generate a new keystore:
keytool -genkeypair -v -keystore upload-new.jks \ -alias upload -keyalg RSA -keysize 2048 -validity 9125 - Export its certificate:
keytool -export -rfc -keystore upload-new.jks \ -alias upload -file upload_certificate.pem - In Play Console, go to App signing and request an upload key reset, attaching that
.pem. - Google reviews it. Expect a few days. Once approved, sign future uploads with the new key.
Users are unaffected throughout — the app signing key never changed, so updates still install over existing versions.
Note the app signing key certificate itself does not change, so your registered SHA-1 fingerprints for Google Sign-In, Maps and App Links stay valid. Only add the new upload key's fingerprint if you use those services in debug builds signed with it.
If you are not enrolled: the outlook is bad
For older apps still publishing APKs signed with your own key and no Play App Signing, losing that key means you cannot publish updates to that listing. There is no reset path, because Google never held the key.
Your options:
- Search harder. Old machines, CI secret stores, password manager attachments, email attachments to yourself, backup drives, the original developer's laptop. Recovery is far more common than people expect.
- Publish a new listing with a new
applicationId. You lose installs, ratings and reviews, and existing users must migrate manually. Unpleasant but survivable. - Contact Play support. Rarely productive for a genuinely lost key, but if you still have the key and only lost the password, it is worth asking.
Lost only the password, not the file?
There is no supported recovery. Brute-forcing your own keystore is technically possible with tools like keystore-cracker if you remember the rough shape of the password, and is worth an afternoon before you give up. Otherwise treat it as a lost key.
Make it not happen again
- Store the keystore in a password manager as an attachment, with the passwords in the same entry. Not in the repo — anyone with repo access could sign as you.
- Keep a second copy offline, on an encrypted drive.
- Write down the alias. People lose the alias more often than the file.
- Use a long validity. 9125 days (25 years) is the usual choice; Play requires the key to be valid until at least 2033.
- In CI, store it as an encrypted secret, never committed.
To check which fingerprints you currently have registered and which one production actually uses, the keystore SHA-1 helper assembles the commands and points at the right Play Console page.