How to find out SHA1 in Android Studio: all methods

Development of mobile applications for the platform Android is inextricably linked with the need to correctly configure security and integrate third-party services. One of the critical parameters that often raises questions among beginners and even experienced developers is SHA1 hash the signature key fingerprint. This unique identifier is required to authorize your application in Google services such as Firebase, Google Maps or Google Sign-In.

Without entering this value correctly into the developer console, application features that require authentication simply will not work. You may encounter authorization errors or messages stating that API key does not have access. Understanding where and how to find this string of characters saves hours of debugging and prevents failures during the testing phase.

There are several proven methods for extracting this information directly from the development environment. We will look at both built-in tools Android Studioand classic console utilities that work regardless of the IDE version. The choice of a specific method depends on your preferences and the current project configuration.

Purpose of SHA1 fingerprint in the Android ecosystem

Hash SHA-1 (Secure Hash Algorithm 1) is a cryptographic function that converts your signature key data into a unique, fixed-length string. In the context of mobile development, this hash serves as the digital passport of your application. Google services use it to make sure that the request to the API comes from your legitimate application, and not from third-party software trying to steal data.

It is especially important to distinguish between fingerprints for different build modes. When developing, you use a debug key (debug keystore), which is generated automatically. However, publishing in Google Play requires a release key, the hash of which will be completely different. If you register only the debug key in Firebase, users of the version downloaded from the store will not be able to log in.

⚠️ Attention: Never use the same hash for the test and production versions of the application. Google services require registering both fingerprints separately to work correctly in different environments.

Incorrect configuration of this parameter often leads to silent crashes when the application simply does not perform an action without explicitly logging an error. Therefore, checking the hash consistency in the developer console and in the real application is a mandatory step before release.

Using the built-in Signing Report panel

The fastest and most convenient way to get the necessary information is use the built-in tool Android Studio. This method does not require knowledge of console commands and works directly in the GUI. It is ideal for those who prefer visual project management.

To begin, open your project in the development environment. In the right vertical menu, find the tab Gradle. If it is hidden, it can be activated through the menu View → Tool Windows → Gradle. In the project tree that opens, you need to expand the structure of your module (usually it is called app), then go to the folder Tasks, then to android and find the task signingReport.

Run this task by double clicking or through the context menu. A window Runwill open at the bottom of the screen, where a detailed report will be displayed. Here you will see a table with information about all signature configurations: Variant, Config, Store, Certificate and, most importantly, SHA1 and SHA-256. Copy the required line corresponding to your build (debug or release).

The advantage of this method is that it immediately shows hashes for all build options, including different flavorsif they are configured in the project. You do not need to switch configurations manually to see the difference between the debug and release key.

Receiving data through the keytool console

If for some reason the graphical interface does not display the necessary data or you are working in an environment without an IDE, the utility keytoolcomes to the rescue. It is included Java Development Kit (JDK) and allows you to manage key stores directly via the command line. This method is considered more reliable and universal.

To perform the operation, you will need to know the exact path to the key storage file (keystore) and its password. For the default debug key on Windows systems, the path is usually C:\Users\UserName\.android\debug.keystore, and the password is often android. The command is executed in the terminal or command line.

keytool -list -v -keystore "path_to_keystore_file" -alias androiddebugkey -storepass android -keypass android

After entering the command, the system will ask for confirmation or immediately display detailed information about the certificate. In the output, find the line SHA1. Note that the output format may contain colons between bytes, which sometimes need to be removed when entering into some consoles, although modern Google services usually accept delimited format.

⚠️ Warning: Make sure the JAVA_HOME environment variable is set correctly. If the terminal says "keytool: command not found", add the path to the JDK bin folder to the system PATH.

Using keytool gives you full control over the process. You can export the certificate, change the password, or create a new store. This is a fundamental tool for any developer working with cryptography in Java i Kotlin.

What to do if you forgot your keystore password?

If you have lost your release keystore password, it is impossible to recover it. You will have to create a new keystore and a new app package with a different name, since you cannot update an existing app on Google Play with a new key. Always keep backup copies of passwords in a password manager.

Automatic output in the Gradle build window

Modern versions of Android Studio and the Gradle plugin allow you to configure automatic output of hashes directly to the build window (Build output). This eliminates the need to run a separate task or open a terminal each time. The information appears immediately after successful compilation of the project.

To activate this function, you need to make small changes to the file build.gradle of your module. The block android adds a configuration that causes the printing system to output a signature report on each build. This is especially convenient when frequently switching between versions.

Parameter	Default value	Description
debug.keystore	Auto-generation	Path to debug key
storePassword	android	Debug storage password
keyPassword	android	Debug key password
alias	androiddebugkey	Key alias

After configuration when pressing the button Build or Run a block of text with a title Signing Reportwill appear in the console. It will list all the necessary hashes. This approach makes the development process more transparent and reduces the risk of human error when copying data from third-party windows.

However, it is worth remembering that this method only displays information for the configuration that is currently being collected. If you need to compare debug and release versions, you will have to switch Build Variant and build the project twice.

Differences between Debug and Release keys

It is critical to understand the difference between debug and release certificates. Debug key is created automatically when you first install Android Studio and has a time-limited validity period (usually 365 days). After the expiration date, the IDE generates a new key, which will lead to a change in the SHA1 hash.

If you register a hash from a temporary debug key in Firebase, and the next day it is updated, your application will stop working with Google services until the configuration is updated. Therefore, for long-term development and testing on real devices, it is recommended to create your own debug key with a long validity period or use a release key even at the testing stage.

Release key is a key that you create yourself, give it a password and store it in a safe place. Its hash never changes unless you lose the storage file. It is this hash that should be the main one in the settings of production services. An error in choosing the key type is one of the most common causes of authorization problems.

⚠️ Attention: The validity period of the standard debug-keystore is 1 year. After this period, Android Studio will create a new key, and the old SHA1 will no longer be relevant.

When transferring a project to another developer or when building on a CI/CD server, make sure that the correct key store is used. A mismatch between the key on the build server and the local computer will lead to the fact that the built version of the application will not pass signature verification in the store or will not connect to the backend.

Solving common problems and errors

Even after following all the instructions, developers may encounter a situation where Google services do not accept the entered hash. A common reason is confusion between the SHA1 and SHA-256formats. Some new services require a 256-bit hash, while the documentation may still refer to SHA1 in the old fashioned way.

Also, the problem may lie in the presence of spaces or extra characters when copying. The hash string must be clean, with no hidden line breaks. If you are copying data from the terminal, be sure not to include extra spaces at the beginning or end of the line. In some cases, manual entry or clearing a line in a text editor helps.

Another nuance is related to updating Google Play App Signing. If you enable this function, then for external services (for example, Firebase) you need to use not the hash of your Upload Key, but the hash of the App Signing Key, which is stored by Google. You can find it in the Google Play console in the signing settings section.

If all else fails, try clearing the project cache through the menu File → Invalidate Caches / Restart. Sometimes Android Studio caches old signature data and displays outdated information in reports. Restarting the development environment often solves such mysterious problems.

FAQ: Frequently Asked Questions

Where can I find SHA1 for an already published application on Google Play?

Go to Google Play Console, select an application, go to the "Application Settings" → "Application Information" section. The "App signing" block will contain the SHA-1 hash for the key that signed the application in the store. Copy it exactly to configure services.

Is it possible to change the SHA1 fingerprint without rebuilding the application?

No, the SHA1 hash is a mathematical consequence of the contents of your signature key. It can only be changed by generating a new key (new keystore). However, this will require creating a new application package with a different name, since you cannot update an existing application with a new key.

Why does the command line display the error "Keystore was tampered with, or password was incorrect"?

This error means that the password entered does not match the specified storage file. Check whether you specify the correct file in the parameter -keystore. For the debug key, try the standard password android. If you created the key yourself, make sure that you do not mix up the vault password and the key password.

Do you need to add SHA1 for each new application build?

No, if you use the same file keystore for signing, the SHA1 hash will remain the same for all builds signed with this key. You only need to add it to the developer console once. The exception is the expiration of the debug key.