Type paths and options. We print keytool, zipalign, apksigner, and legacy jarsigner blocks. We do not create a keystore, we do not sign bytes, and Play App Signing will still change the APK testers install.
Adjust the form to generate commands.
The form collects a shell style (POSIX or Windows quoting), keystore path, alias, validity in days, key algorithm, key size, distinguished name, and three filenames: unsigned, aligned, and signed. It prints blocks of shell. It does not open the keystore, does not ask for a password, and does not add --ks-pass or --key-pass. apksigner and keytool will prompt in your terminal. If you type a password into the distinguished-name field, it will be copied into the keytool -dname value. Do not do that. The field is a certificate subject such as CN=App, not a secret.
Default strings are release.keystore, alias release, validity 10000 days, RSA, the size you pick, unsigned app-release-unsigned.apk, aligned app-release-aligned.apk, signed app-release-signed.apk. Change them to real paths before you paste the block into a shell. The page does not check that those paths exist.
Choose apksigner unless you are maintaining a v1-only pipeline. The blocks are:
keytool -genkeypair -v -keystore … -alias … with the algorithm and size, -validity, and -dname. Run this once, when you create the upload key. Running it again with the same filename creates a different key or fails, depending on whether the file is already there. It does not enroll the key with Play.zipalign -v -p 4 UNSIGNED ALIGNED. Page alignment comes before apksigner. If zipalign is not on your PATH, the comment in the block points at build-tools/<version>/zipalign. The page does not search your SDK directory.apksigner sign --ks KEYSTORE --ks-key-alias ALIAS --out SIGNED ALIGNED. With the v1+v2 box checked, the command also passes --v1-signing-enabled true --v2-signing-enabled true. With the box unchecked, those flags are omitted and the comment says defaults depend on the build-tools version.apksigner verify --verbose SIGNED.That signature is an upload signature if this keystore is your upload key. Play App Signing can replace it on the APKs users install. The whole-file hash then changes. The APK Analyzer hashes whatever you drop. It will not show Play’s app signing certificate. See desk hash versus the installed file.
The jarsigner method prints a different sequence, because zipalign after a v1 signature is the documented jarsigner flow, and zipalign after a v2 signature breaks v2. The blocks sign the unsigned APK in place with jarsigner -verbose -sigalg … -digestalg SHA-256, then zipalign that file to the aligned path, then jarsigner -verify -verbose -certs on the aligned file. Keep a copy of the unsigned APK. jarsigner rewrites its input. This path does not produce a v2 block. Prefer apksigner for anything you will upload to Play.
Copy one block at a time into a terminal on a machine that has a JDK and Android build-tools. Answer the password prompts there. Then run verify and keep the certificate line with the release notes. Compare it to the upload certificate shown in Play Console. A mismatch means you signed with the wrong keystore. The generator cannot see Play Console.
Gradle projects that already have a signingConfig do not need these commands to produce a release. You can still use the verify command on Gradle’s output. Do not point keytool at the Play app signing key. You do not have that key if Google holds it.
This is apksigner verify --verbose on a sample APK signed with build-tools 36.0.0 after zipalign -p 4. The keystore subject is CN=Example. Passwords are not in the output. This is not a Play upload certificate, and it was not enrolled in Play App Signing.
Verifies Verified using v1 scheme (JAR signing): false Verified using v2 scheme (APK Signature Scheme v2): true Verified using v3 scheme (APK Signature Scheme v3): true Verified using v3.1 scheme (APK Signature Scheme v3.1): false Verified using v4 scheme (APK Signature Scheme v4): false Verified for SourceStamp: false Number of signers: 1
How the file hash from the analyzer relates to the certificate these commands can produce is a file hash is not a signing certificate. The release checklist that includes this verify step is the publishing checklist. Key size and algorithm in the form are passed through to keytool’s flags after a small normalization in the script: an EC key will not keep an RSA size such as 2048, and an RSA key will not keep an EC size such as 256. If you need a key type the form does not list, write the keytool command yourself. Do not hide extra flags in the distinguished-name box. The value of this page is the order — align then apksigner, or jarsigner then align — and the reminder that passwords stay in the terminal prompt.