The development of modern applications for the Android platform is inextricably linked with the integration of third-party services, such as Firebase, Google Maps or social networks. To securely communicate with these APIs, your project requires a cryptographic signature known as SHA1. Without the correct hash, the application will not be able to authenticate, and the Push Notifications or Maps functionality will simply stop working.
Many new developers have difficulty finding this string because it is not explicitly displayed in the IDE. There are several methods for retrieving data, from using built-in Gradle tasks to manually entering commands in the terminal. The choice of a specific method depends on your operating system and the current project configuration.
In this article we will analyze in detail all the current options for obtaining a certificate fingerprint. You will learn how the debug key differs from the release version, how to automate the process and what pitfalls may be encountered on the way to setting up the security of your application.
Why do you need the SHA1 hash and where is it used
The hash SHA1 (Secure Hash Algorithm 1) is a unique string of 40 hexadecimal characters, which is generated based on your signature key. This identifier serves as a digital fingerprint confirming the authorship of the application. Google services use it to verify that the request to the API comes from a legitimate developer, and not from an attacker trying to tamper with your software.
Most often, the need to find out this parameter arises when connecting Firebase Authentication or Google Sign-In. If you forget to add the hash to the developer console, users will experience a login error or silencet failure, where the application simply does not respond when the authorization button is clicked. This is also critical for operation Google Maps Android API, without which the cards will not be displayed on the device screen.
It is important to understand the difference between assembly modes. During the development process, you use a debug key (debug.keystore), which is generated automatically. However, when publishing an application on the Google Play Store, a completely different one is used, which you create yourself. For each of these modes, a unique SHA1 is generated, and both of them must be registered with the corresponding services. release-key, which you create yourself. A unique SHA1 is generated for each of these modes, and both must be registered with the corresponding services.
⚠️ Attention: Never publish your private key or keystore file publicly. The SHA1 hash itself is not secret and can be transmitted, but the .jks or .keystore file must be kept in the strictest confidence.
There is also the concept of SHA-256, which is often required by modern services along with the outdated SHA-1. The principles for obtaining them are identical, only the hashing algorithm in the command changes. Ignoring this requirement may result in new API functions being unavailable for your project, even if basic authorization works.
Method 1: Using the Gradle panel in Android Studio
The simplest and most intuitive method that does not require knowledge of console commands is to use the built-in Gradle tool. In modern versions Android Studio this panel allows you to run signing tasks directly from the interface. To begin, open the tab Gradle, which is usually located on the right side of the IDE window.
In the project tree that opens, you need to expand the path app → Tasks → android → signingReport. Double clicking on the task signingReport will start the build process and display the result in the lower panel Run. Here you will see detailed information about all build options for your application, including paths to key files and the hashes themselves.
- 🔍 Find the section corresponding to your current build option (for example, Variant: debug).
- 🔐 Copy the line starting with
SHA1:, this is the one you need fingerprint. - 📂 Pay attention to the field
Storeto understand which keystore file is used.
This method is convenient because it automatically determines the active configuration. You don't need to manually enter paths or passwords since Gradle already knows all the parameters from the file build.gradle. If you use several modules in a project, the task will be performed for each of them, which allows you to quickly collect all the necessary fingerprints in one place.
If the Gradle panel is not displayed, enable it through the View → Tool Windows → Gradle menu or restart the IDE after importing the project.
However, this method has a caveat: it shows information only for those build options that succeed are compiled. If your project has code errors that prevent it from building, the task signingReport may fail. In this case, you will have to move on to lower-level methods of interacting with the system.
Method 2: Keytool command via terminal
A universal method that works on any operating system where JDK (Java Development Kit) is installed is using the utility keytool. This tool comes standard with Java and allows you to manage keystores and certificates. First, you need to open a terminal or command line.
The first step is to go to the directory where your debug key is located. By default, on Windows systems it is located at C:\Users\YourName\.android\debug.keystore. On macOS and Linux, the path will look like ~/.android/debug.keystore. If you are using your custom release key, specify the path to it.
keytool -list -v -keystore "file_path/debug.keystore" -alias androiddebugkey -storepass android -keypass androidAfter entering the command, the system will ask for confirmation or immediately provide information if the passwords are correct. In the output, find the line SHA1. Please note that for the debug key the default passwords are always android, and the alias is androiddebugkey. For release keys, you will have to enter the password that you specified when creating the repository.
☑️ Check before launching keytool
If the command keytool is not recognized by the system, it means that the path to the Java binary files has not been added to the environment variables. In this case, you can use the full path to the executable file, for example "C:\app Files\Java\jdk-17\bin\keytool.exe". This ensures that the utility runs regardless of PATH settings.
Method 3: Android Firebase Assistant plugin
For those who actively use the Google ecosystem, there is a specialized assistant within the development environment itself. The plugin Firebase Assistant not only helps connect the project to the database, but also automatically retrieves the necessary hashes. This is the most integrated approach, minimizing manual work.
To use this tool, go to menu Tools → Firebase. In the right panel, select the service you want to connect, for example, Authentication or Analytics. Follow the instructions in the connection wizard. At one stage, the system will automatically calculate the SHA1 from your current debug key and offer to add it to the Firebase project.
| Method | Complexity | Requirements | Best for |
|---|---|---|---|
| Gradle Panel | Low | Android Studio | Fast verification during development |
| Keytool | Medium | JDK, Terminal | Obtaining hashes for Release versions |
| Firebase Assistant | Low | Plugin, Google Account | Initial Firebase project setup |
The advantage of this approach is automation. You don't have to copy and paste lines manually, eliminating the risk of typos. In addition, the plugin immediately checks the validity of the key and reports configuration errors if there are any. However, it only works in conjunction with Google services and is not suitable if you need a hash for a third-party service that is not integrated into the studio.
Differences between Debug and Release keys
It is critically important to understand that the debug and release keys are two different files with different passwords and, therefore, different hashes. The Debug key is created automatically when the project is first built and has standard credentials. It is convenient for testing, but unsafe for publishing.
You create the Release key yourself through the wizard Generate Signed Bundle / APK. This key will be used to sign the application in the store. If you lose this file or forget your password, you will never be able to update your app on Google Play because the signatures will not match. Therefore, it should be treated with extreme caution.
When registering in developer consoles, both hashes are often required. This allows the application to work correctly both in debug mode on your phone and in the final version downloaded by the user. Confusion between them is a common cause of type errors Sign-in failed on testers' devices.
⚠️ Attention: The SHA1 hash obtained for the debug key will NOT work for a signed APK distributed through the store. Be sure to generate and add a fingerprint from your release storage.
To obtain the release key hash, use the method with keytool, specifying the path to your file .jks or .keystore. You will need to enter the password you created when creating the key. Automatic methods via Gradle will also show this hash if you have configured signing release versions in the file build.gradle.
Solving common problems and errors
One of the most common problems is error Keystore was tampered with, or password was incorrect. This happens if you enter an incorrect keystore password. For the debug key, remember that the default password is android, and it is case sensitive. If you changed it manually, you will have to remember the new combination.
Another situation: the command keytool returns an empty result or an access error. Check the storage file permissions. On some systems the file may be blocked or hidden. Also make sure that you are using the exact version of Java that is configured in Android Studio, since different versions of the JDK may have differences in how the utilities work.
What to do if the debug key has expired?
Debug keys are valid for 365 days. If the time limit has expired, simply delete the debug.keystore file from the .android folder. During the next build, Android Studio will automatically create a new key with a new expiration date and a new SHA1, which will need to be updated in the services.
If you changed your computer or copied the project, the paths to the keys may be confused. In the file build.gradle check the block signingConfigs. Make sure the paths are correct relative to the project root or use absolute paths. An error in the path will result in Gradle not finding the file and being unable to generate the report.
⚠️ Note: The Android Studio interface and Gradle task names may change slightly in new versions of the IDE. If you do not find the signingReport item, use the action search (Ctrl+Shift+A) and enter the name of the task.
Questions and answers (FAQ)
Where exactly is the debug.keystore file on my computer?
By default, the file is located in the user's hidden folder. On Windows, path: C:\Users\UserName\.android\debug.keystore. On macOS and Linux: ~/.android/debug.keystore. To see the .android folder on Windows, turn on show hidden files in Explorer.
Can you use the same SHA1 for multiple applications?
Yes, you can use one and the same debug key for all your projects in development mode. However, for release versions on Google Play, each application must be signed with its own unique key (or Google Play signing key), and for each you need to register a separate SHA1 in the service consoles.
What is SHA-256 and do you need to specify it?
SHA-256 is a more modern and secure hashing algorithm. Many new Firebase and Google services require both SHA-1 and SHA-256 hashes. You can get it with the same command keytool, replacing the argument -list with -list -v, where all available fingerprints will be displayed.
I have lost the release key, what should I do?
If you have not downloaded app on Google Play, simply create a new key and re-sign the APK. If the application is already in the store and you do not use "Play App Signing", it is impossible to restore access to the update - you will have to publish the application as new with a different package. When using Play App Signing, you can reset the key through Google support.
Why does Gradle throw an error when running signingReport?
Most often this is due to syntax errors in Gradle files or lack of internet (if synchronization is required). Check that the file build.gradle is correct. Also try running the command Invalidate Caches / Restart in the File menu to clear the build system cache.