If you forgot your Android keystore password, lost your .jks file, or no longer know the key alias password, you may not be able to upload a new app update to Google Play. The fix is usually an Android upload key reset: create a new upload key, export certificate.pem, and ask Google Play Console to register the new upload certificate.
This only works when your app uses Play App Signing. In that setup, Google keeps the app signing key, and your local keystore is only the upload key used to prove that the release came from you.
Quick fix: create a new upload key and certificate.pem
Run these two CMD commands in order.
keytool -genkeypair -alias mykey -keyalg RSA -keysize 2048 -validity 20000 -keystore mypath.jkskeytool -export -rfc -keystore mypath.jks -alias mykey -file certificate.pemThe first command creates a new Android keystore named mypath.jks. The second command exports the public certificate file named certificate.pem. Google often calls this file upload_certificate.pem; both names refer to the public upload certificate you submit during the Play Console reset flow.
When Google Play upload key reset works
Google Play upload key reset works when your app is enrolled in Play App Signing and you lost the private upload key, forgot the Android keystore password, or can no longer sign updates with the old keystore.
If you lose the upload key, Google can register a new one for future uploads. According to Google's Play App Signing documentation, resetting the upload key does not change the app signing key Google Play uses to deliver the app to users.
Official reference: Use Play App Signing - Google Play Console Help
Android reference: Sign your app - Android Developers
Android upload key vs app signing key
The app signing key is the final key used to sign the app that users install from Google Play. With Play App Signing, Google stores and protects this key.
The upload key is the key you use locally to sign an APK or Android App Bundle before uploading it to Google Play Console.
That difference matters. If your upload key is lost, Google can reset the upload key. If you are not using Play App Signing and you lose the original app signing key, the situation is much harder because Google may not have a separate signing key to protect your update path.
Common Android keystore errors this fixes
You may see errors like these when building or uploading an Android release:
Keystore was tampered with, or password was incorrect
No key with alias found in keystore
Your Android App Bundle is signed with the wrong key
These errors usually mean one of these things:
- The keystore password is wrong.
- The key alias is wrong.
- The key password is wrong.
- The
.jksfile is not the original upload key. - The original upload key is lost.
If you cannot recover the old keystore details, stop guessing passwords. Create a new upload key, export its public certificate, and submit it to Play Console.
If you are preparing a release after fixing the key, use a release checklist before uploading the next build. I keep a separate Google Play release checklist for that final pass.
Before you run the CMD commands
You need Java installed because the keytool command comes with the JDK.
Open Command Prompt and check:
keytool
If CMD shows keytool help text, you can continue. If it says the command is not recognized, install the JDK and make sure Java is added to your system PATH.
How to generate a new Android keystore
Run this command in CMD:
keytool -genkeypair -alias mykey -keyalg RSA -keysize 2048 -validity 20000 -keystore mypath.jksThe same command in a code block:
keytool -genkeypair -alias mykey -keyalg RSA -keysize 2048 -validity 20000 -keystore mypath.jks
CMD will ask for a keystore password and certificate information. Use a strong password and save it somewhere secure.
What the command means
keytool is Java's command line tool for creating and managing keys.
-genkeypair creates a new public and private key pair.
-alias mykey sets the key alias. You can change mykey, but you must remember the exact alias.
-keyalg RSA uses the RSA key algorithm.
-keysize 2048 creates a 2048-bit key.
-validity 20000 makes the key valid for 20,000 days.
-keystore mypath.jks creates the new keystore file named mypath.jks.
After this command finishes, you should have a new file:
mypath.jks
Do not send this .jks file to Google. This is your private keystore file, and you must keep it safe.
How to generate certificate.pem for Google Play
Now export the public certificate from your new keystore:
keytool -export -rfc -keystore mypath.jks -alias mykey -file certificate.pemThe same command in a code block:
keytool -export -rfc -keystore mypath.jks -alias mykey -file certificate.pem
CMD will ask for the keystore password. Enter the password you created in step 1.
After this command finishes, you should have:
certificate.pem
This is the file you upload or attach when requesting the Google Play upload key reset.
Google's documentation and support emails may call the same file upload_certificate.pem. If you prefer that name, you can run the command like this:
keytool -export -rfc -keystore mypath.jks -alias mykey -file upload_certificate.pem
What the export command means
-export exports the certificate from the keystore.
-rfc saves the certificate in PEM format.
-keystore mypath.jks tells keytool which keystore to read.
-alias mykey selects the key inside the keystore.
-file certificate.pem saves the output certificate as certificate.pem.
How to request upload key reset in Play Console
Open Google Play Console and select your app.
Go to:
Setup -> App integrity
Find the upload key section and choose the option to request or replace the upload key. Upload or attach:
certificate.pem
The request may need to be submitted by the Play Console account owner or an admin with the right permission.
Wait for Google's confirmation
After submitting the request, wait for Google to register the new upload key. Once Google confirms the reset, you can sign future releases with the new mypath.jks file.
Do not upload a new app bundle signed with the new key before Google confirms the reset. Play Console will still reject it until the new upload certificate is registered.
Update your project signing settings
After the reset is approved, update your Android project to use the new keystore.
Keep these values:
Keystore file: mypath.jks
Key alias: mykey
Keystore password: the password you entered
Key password: the password you entered
For many Gradle projects, the values are stored in a key.properties file or in local signing settings. A typical setup looks like this:
storeFile=mypath.jks
storePassword=your_store_password
keyAlias=mykey
keyPassword=your_key_password
Never commit real keystore passwords to GitHub or a public repository.
If you are publishing from a newer personal Play Console account, remember that signing is only one part of release readiness. You may also need to complete Google's closed testing flow; this guide explains the Google Play 12 testers requirement.
Common mistakes to avoid
Sending the wrong file to Google
Google needs the public certificate file:
certificate.pem
Do not send:
mypath.jks
The .jks file contains your private key material and should stay private.
Changing the alias between commands
If you generate the keystore with:
-alias mykey
You must export the certificate with the same alias:
-alias mykey
If the alias does not match, keytool will not export the correct certificate.
Uploading the new AAB too early
The new key only works after Google approves and registers it. Wait for the Play Console confirmation before uploading your next release.
Losing the new keystore again
Back up the new .jks file in at least two secure places. Store the password in a password manager. If you work with a team, make sure the right owner has access.
FAQ
Can I recover a lost Android keystore file?
No. You cannot recreate the exact same Android keystore file after it is lost because the private key is unique. If your app uses Play App Signing, the practical fix is to generate a new upload key and request a Google Play upload key reset.
Can Google reset my upload key?
Yes, Google can reset a lost or compromised upload key for apps enrolled in Play App Signing. The Play Console account owner or an authorized admin usually needs to start the reset request and provide the new upload certificate.
Does upload key reset affect existing app users?
No. Resetting the upload key does not affect existing users when Play App Signing is enabled. Google still signs delivered apps with the app signing key, while the new upload key is only used for future uploads to Play Console.
Should I upload the .jks file or certificate.pem to Google?
Upload certificate.pem or upload_certificate.pem, not the .jks file. The .jks file contains private key material and should stay private. Google only needs the public upload certificate for the reset request.
What if Play App Signing is not enabled?
If Play App Signing is not enabled and you lost the original app signing key, you may not be able to publish updates to the same app package. Check the App integrity page in Play Console and contact Google Play Developer Support for your specific account and app state.
Final CMD commands
Use these two commands in order:
keytool -genkeypair -alias mykey -keyalg RSA -keysize 2048 -validity 20000 -keystore mypath.jks
keytool -export -rfc -keystore mypath.jks -alias mykey -file certificate.pem
Conclusion
Forgetting your Android keystore password is stressful, but it does not always mean you need to abandon your published app. If Play App Signing is enabled, the practical fix is to create a new upload key, export certificate.pem or upload_certificate.pem, and request an upload key reset from Google Play Console.
The important rule is simple: keep the new .jks file private, submit only the .pem certificate to Google, and update your release signing settings after the reset is approved.
