Every Android app must be digitally signed before it can be distributed. Signing is not an optional formality: Android's installer refuses to install apps that aren't signed, and Google Play rejects unsigned uploads. Understanding why signing exists helps you make better decisions about keystore management.
Why Signing Exists
App signing solves an identity problem: how does a user's device know that an update to an app comes from the same developer who published the original? Without signing, an attacker could distribute a malicious app with the same package name as a legitimate one, and devices would have no way to distinguish them.
Signing works like this:
- You generate a private key and keep it secret
- When you build an app, the build tool creates a cryptographic signature using your private key and embeds it in the APK or AAB
- The corresponding public certificate is also embedded in the app
- When Android installs an update, it checks that the update's certificate matches the certificate of the already-installed version
- If the certificates don't match, the update is rejected
This means: whoever holds the private key is, in effect, the authoritative publisher of that app. The key is the identity proof.
What a Keystore Is
A keystore is a file (with a .jks or .p12 extension) that stores one or more private keys protected by a password. Think of it as a password-protected vault containing your signing credentials.
A keystore contains:
- One or more key entries, each identified by an alias
- Each key entry contains a private key and a certificate chain
- All key entries are protected by the keystore password
- Individual keys may have their own separate password
Play App Signing
Google Play uses a two-key system for new apps:
- Upload key: Your key. You sign your AAB with it and upload to Play Console. Only you have this key.
- App signing key: Google's key. Google re-signs the APK that's actually distributed to users' devices. Google manages this key.
This separation has an important practical benefit: if your upload key is compromised or lost, you can request a new upload key from Google Play Console without affecting your app's installed base. Users' devices receive APKs signed with Google's app signing key, which remains unchanged.
All apps created after August 2021 are required to use Play App Signing. For older apps, enrollment is optional but strongly recommended.
The Consequence of Losing a Key
If your upload key is lost and you haven't enrolled in Play App Signing (or enrolled but haven't set up a recovery backup), you cannot publish updates to your existing app listing. You would have to create a new app on Play Store with a different package name, losing all existing installs, ratings, and reviews.
This is why keystore backup is treated seriously by Android developers. See Managing Your Keystore Securely for backup practices.
How WebToAppConvert Handles Signing
WebToAppConvert signs your AAB during the build process. You can provide your own keystore (for existing apps migrating to WebToAppConvert), generate a new key (for new apps), or let WebToAppConvert manage the key automatically.
Regardless of which option you choose, the signing is performed using the same tools (apksigner and the standard Android build toolchain) that professional Android developers use.