Keystore SHA-1 Helper
Build the correct keytool command to read SHA-1 and SHA-256 fingerprints from your debug or release keystore on Windows, macOS or Linux — plus where to find the fingerprint Google Play actually signs with.
Free · No signup · Runs entirely in your browser
Build your command
Nothing is uploaded — you run this locally.
Run this in your terminal
keytool -list -v \ -alias androiddebugkey \ -keystore ~/.android/debug.keystore \ -storepass android -keypass android
Look for the “Certificate fingerprints” block in the output — SHA1 and SHA256 are listed there.
Easier: let Gradle do it
Prints fingerprints for every build variant, with no keytool path hunting.
From your project root
./gradlew signingReport
The fingerprint production actually uses
Play re-signs your app. This is the certificate your users run.
- 1. Play Console → your app → Test and release → Setup → App signing
- 2. Copy SHA-1 and SHA-256 from App signing key certificate
- 3. Firebase Console → Project settings → your Android app → Add fingerprint
- 4. Download the updated
google-services.jsonand ship it
Three certificates, and only one of them matters in production
Most fingerprint problems come from not realising there are three different signing certificates in play:
- Debug keystore — created automatically by Android Studio. Only signs local development builds.
- Upload keystore — the
.jksyou generated. It authenticates uploads to Play Console and nothing else. - Play App Signing certificate — the key Google signs the delivered app with. This is what runs on your users’ devices.
If Google Sign-In, Maps or App Links work on your machine and break for real users, you almost certainly registered the first or second and not the third.
Getting the production fingerprint
- Play Console → your app → Test and release → Setup → App signing.
- Copy the SHA-1 and SHA-256 under “App signing key certificate”.
- Firebase Console → Project settings → your Android app → Add fingerprint.
- Download the refreshed
google-services.jsonand ship it.
Register all three fingerprints. Firebase accepts multiple per app, and doing so means sign-in works in every variant without further thought.
Symptoms of a wrong fingerprint
- Google Sign-In returns status code 10 (DEVELOPER_ERROR).
- Maps shows a blank grey grid.
- App Links open in the browser instead of your app.
Frequently asked questions
- Why does Google Sign-In work in debug but fail in the Play build?
- Because Play App Signing re-signs your app with Google’s own key. The fingerprint users run is the App signing key certificate in Play Console, not your upload keystore. Register that one in Firebase too.
- What is the debug keystore password?
- The auto-generated debug keystore always uses the alias "androiddebugkey" with the store and key password "android". It lives at ~/.android/debug.keystore on macOS and Linux, and %USERPROFILE%\.android\debug.keystore on Windows.
- What does DEVELOPER_ERROR / status code 10 mean?
- Almost always a fingerprint or package-name mismatch: the SHA-1 of the certificate signing the running build is not registered against that package name in Firebase or the Google Cloud console.
- Do you ever see my keystore or password?
- No. This page only assembles a command string in your browser. Nothing is uploaded, and no keystore is read here — you run the command yourself on your own machine.
- keytool is not recognised as a command. What now?
- keytool ships with the JDK. Either add the JDK bin directory to your PATH, or use ./gradlew signingReport from your project root, which needs no keytool path at all.