APK SHA-1 and SHA-256 fingerprints for Firebase and Google sign in
· 6 min read
Firebase, Google sign in, Maps and several other Google APIs identify your Android app by two things: its package name and the fingerprint of the certificate that signed it. Get the fingerprint wrong, or forget one of the keys your app is signed with, and sign in fails on some builds and works on others. The usual symptom is Google sign in failing with error code 10.
This post shows every common way to read the SHA-1 and SHA-256 fingerprint, from an APK file, from a keystore and from Gradle, and explains which fingerprints you actually need to register. Commands and console paths were checked on November 9, 2026 against Google's "Authenticating your client" guide.
Which fingerprint, from which key
An Android app can be signed with more than one key over its life, and each one has its own fingerprint:
| Key | Signs | Where to get the fingerprint |
|---|---|---|
| Debug key | Builds you run from Android Studio | Your ~/.android/debug.keystore; different on every machine |
| Upload key (or release key) | Builds you sign yourself, and the bundles you upload to Play | Your release keystore |
| App signing key (Play App Signing) | Every copy users install from Google Play | Play Console |
| A test key used by a sharing service | APKs made for testers from an .aab | The APK itself |
Register the fingerprint of every key that signs a build which needs Google sign in or Firebase. Most teams need at least the debug key, the upload key and the Play app signing key.
From an APK file
keytool
keytool -printcert -jarfile app-release.apkThis prints the owner, the validity dates and the SHA-1 and SHA-256 fingerprints in the colon separated, upper case form that Firebase and Google Cloud show. One catch: keytool reads the old v1 (JAR) signature. Many modern APKs, especially those with a minimum SDK of 24 or higher, carry only v2 or v3 signatures, and then keytool reports that the file is not a signed jar even though it is signed. Use apksigner in that case.
apksigner
apksigner verify --print-certs app-release.apkapksigner ships with the Android SDK build tools. It reads every signature scheme and prints the certificate's SHA-256, SHA-1 and MD5 digests for each signer. The digests are lower case hex without colons; the value is the same as keytool's, only written differently.
In the browser
Our APK analyzer shows the signing certificate's SHA-1, SHA-256 and MD5 in the colon separated upper case form, with copy buttons, plus the subject and expiry. It reads the v3.1, v3, v2 or v1 signature, so it works where keytool says the file is not signed. For a bundle, the AAB inspector shows the same fingerprints for the upload key that signed the .aab. Both read the file in your browser; nothing is uploaded and no account is needed.
From a keystore
For your release or upload key:
keytool -list -v -alias my-upload-key -keystore my-upload-key.jksFor the debug key on macOS or Linux (on Windows the file is in %USERPROFILE%\.android):
keytool -list -v -alias androiddebugkey -keystore ~/.android/debug.keystoreThe debug keystore password is android. Each developer machine and each CI runner that builds debug variants usually has its own debug keystore, so each one has its own fingerprint. If a teammate's debug build fails sign in and yours works, that is why.
From Gradle
./gradlew signingReportThis prints SHA-1, SHA-256 and MD5, plus validity dates, for every variant's signing config. It is the quickest way to see the debug and release fingerprints of the project you have open.
Play App Signing: the fingerprint people forget
Most apps on Google Play use Play App Signing. You sign the .aab with your upload key, and Google re-signs the APKs it delivers with the app signing key it holds. That means the app your users install from Play has a fingerprint you will not find in any keystore on your machine.
Find it in Play Console under Release, Setup, App integrity, in the app signing key certificate section, and add that SHA-1 (and SHA-256) to your Firebase project and Google Cloud OAuth client too. This is the most common reason sign in works in every build you test and then fails for everyone who installs from Play.
Adding the fingerprint to Firebase
- Open the Firebase console, Project settings, and pick your Android app under "Your apps".
- Choose "Add fingerprint" and paste the SHA-1. Add the SHA-256 as well if you use App Check or other features that ask for it.
- Repeat for each key: debug, upload, Play app signing and any test key.
- Download a fresh
google-services.jsonand replace the one in your app module, then build again.
Why Google sign in fails with error 10
Google's CommonStatusCodes.DEVELOPER_ERROR has the value 10 and is described as "The application is misconfigured". With Google sign in it is widely reported to mean that the package name and certificate fingerprint of the installed app do not match any Android OAuth client registered for the project. In practice that is almost always a missing fingerprint: the debug key of a new machine, the upload key, the Play app signing key, or a key used to sign test builds. Find out which key signed the failing APK with one of the methods above, then add that fingerprint.
Test builds made from an .aab
If you upload an .aab to AppForShare, the tool we make, testers get one universal APK built from it. That APK is signed with your workspace's AppForShare test key, or on Pro and Team with your own upload keystore if an Admin has added one in Settings. A test key APK has its own fingerprint, different from your upload key and from Play's app signing key. If those test builds need Google sign in or Firebase features tied to the fingerprint, download the APK from its install page, read its SHA-1 in the APK analyzer, and add it to Firebase. Using your own keystore on Pro or Team avoids the extra fingerprint. Our posts on Android app signing for sideloaded builds and installing an .aab on Android explain the signing side in more detail.
Common questions
Do I need SHA-1 or SHA-256?
Google sign in through Firebase uses the SHA-1. Some features, such as App Check with Play Integrity and app links, use the SHA-256. Adding both for each key avoids surprises.
Why does keytool say my APK is not signed?
The APK carries only a v2 or v3 signature, which keytool -printcert -jarfile does not read. Use apksigner verify --print-certs or the APK analyzer.
Sign in works from Android Studio but not from Google Play. Why?
The Play version is signed with Google's app signing key. Copy that SHA-1 from Play Console, App integrity, into Firebase and download a new google-services.json.
Does the APK analyzer upload my file?
No. It reads the file in your browser. Only the optional "Share this build with testers" button uploads it.
More free tools for builds are on the free build tools page. When your build is ready for testers, create a free account and share it with an install link.
