How to Find Your Google Play App Signing SHA-256 Fingerprint (2026)

Quick Answer

Find your Google Play App Signing SHA-256 in Play Console at Setup → App signing. Find your Upload Key SHA-256 via keytool -list -v -keystore your-keystore.jks -alias your-alias. Add both fingerprints to the sha256_cert_fingerprints array in assetlinks.json — the App Signing key from Play Console and your Upload Key from keytool.

Two Keys, Two Fingerprints — Understanding the Difference

If your TWA app is showing a browser address bar after installation from the Play Store — but works perfectly during local testing — the root cause is almost always a missing or wrong SHA-256 fingerprint in assetlinks.json. Specifically, a mismatch between your Upload Key and your App Signing Key.

Property	Upload Key	App Signing Key (Play Console)
Who manages it?	You (the developer)	Google Play
Used when?	Signing the .aab before upload	Re-signing the app after upload to Play Store
Found where?	`keytool` or `signingReport`	Play Console → Setup → App signing
Format in assetlinks.json?	Add to `sha256_cert_fingerprints`	Add to `sha256_cert_fingerprints`

The Most Common TWA Mistake

Developers add only their Upload Key SHA-256 to assetlinks.json. This works during local testing because the app is signed with the Upload Key. But after uploading to Play Console, Google re-signs the app with the App Signing Key. The TWA then fails Digital Asset Links verification, shows the browser address bar, and gets rejected.

Method 1: Find App Signing SHA-256 in Play Console

Recommended

Open Google Play Console
Select your app
Navigate to Setup → App signing
Under App signing key certificate, find the SHA-256 certificate fingerprint
Click the copy button or select and copy the entire fingerprint (colons and all)

The fingerprint looks like this:

# From Play Console: App signing key certificate
"sha256_cert_fingerprints": [
  "2A:3B:CF:8D:4E:5F:1A:2B:3C:4D:5E:6F:7A:8B:9C:0D:1E:2F:3A:4B:5C:6D:7E:8F:9A:0B:1C:2D"
]
                        

Method 2: Find Upload Key SHA-256 via keytool

For your local keystore

Run the following command in your terminal. Replace the paths and passwords with your actual keystore details:

# For a custom keystore (release or debug)
keytool -list -v -keystore /path/to/your/keystore.jks \
  -alias your-alias-name \
  -storepass your-store-password \
  -keypass your-key-password

# Output includes:
# SHA256: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
                        

For the default debug keystore:

# Default debug keystore — macOS, Linux, Windows
keytool -list -v -keystore ~/.android/debug.keystore \
  -alias androiddebugkey \
  -storepass android \
  -keypass android

# Output:
# SHA256: XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX
                        

Where is my keystore?

If you used Bubblewrap, your keystore is typically in ~/.android/debug.keystore (for development) or the custom keystore you configured in twa-manifest.json. If you used PWABuilder, the keystore path is in your build configuration.

Method 3: Find SHA-256 via Gradle signingReport

Android Studio

In Android Studio, the easiest way to get your signing fingerprints without touching the command line:

Open the Gradle tool window (right sidebar in Android Studio)
Navigate to app → Tasks → android → signingReport
Double-click to run
Look in the Build output for SHA256 under both debug and release signing configs

# signingReport output (look for these lines):
"SHA256": "XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX"
                        

Where to Use Each Fingerprint in assetlinks.json

Once you have both fingerprints, add them both to your assetlinks.json file. Order doesn't matter — just include both:

[
  {
    "relation": [
      "delegate_permission/common.handle_all_urls"
    ],
    "target": {
      "namespace": "android_app",
      "package_name": "com.yourcompany.yourapp",
      "sha256_cert_fingerprints": [
        "# APP SIGNING KEY — from Play Console > Setup > App signing
        "2A:3B:CF:8D:4E:5F:1A:2B:3C:4D:5E:6F:7A:8B:9C:0D:1E:2F:3A",
        "# UPLOAD KEY — from keytool or signingReport
        "AA:BB:CC:DD:EE:FF:00:11:22:33:44:55:66:77:88:99:00:11:22:33"
      ]
    }
  }
]
                

Verify Your assetlinks.json

Test your assetlinks.json with Google's official Digital Asset Links API before submitting your TWA:

# Replace yourdomain.com with your actual domain
https://digitalassetlinks.googleapis.com/v1/statements:list?source.web.site=https://yourdomain.com&relation=delegate_permission/common.handle_all_urls
                    

A successful response returns a statements array containing your package name and fingerprints. An empty response means verification failed — check for typos, wrong fingerprints, or HTTP redirects.

Related Guides

Frequently Asked Questions

Where do I find my Google Play App Signing SHA-256 fingerprint?

In Google Play Console, go to Setup → App signing. The SHA-256 certificate fingerprint is displayed under the App signing key certificate section. Copy it (including the colons) and paste it into your assetlinks.json sha256_cert_fingerprints array.

What is the difference between the App Signing key and the Upload key?

The Upload key is the keystore you use locally to sign your APK or AAB before uploading to Play Console. The App Signing key is a different key managed by Google Play when you opt into App Signing. Google re-signs your app with the App Signing key after upload. For assetlinks.json, you need both fingerprints.

Why do I need two SHA-256 fingerprints in assetlinks.json?

Your TWA app is signed with your local Upload key during development and testing on physical devices. But Google Play re-signs the app with the App Signing key when it goes live. If assetlinks.json only contains the Upload key fingerprint, the TWA shows a browser address bar during Play Store installs. You need both so Digital Asset Links verification succeeds at every stage.

How do I find my Upload key SHA-256 using keytool?

Run: keytool -list -v -keystore /path/to/your/keystore.jks -alias your-alias -storepass yourpassword. The output shows SHA256: XX:XX:XX... (with colons). For the debug keystore: keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android -keypass android.

How do I find my SHA-256 using Gradle signingReport?

In Android Studio, open the Gradle sidebar and run app → Tasks → android → signingReport. The output shows the SHA-1 and SHA-256 fingerprints for both debug and release signing configs.

What if I lost my upload keystore?

If you lost your upload keystore, you can request a reset in Play Console: Setup → App signing → Request upload key reset. Google will generate a new upload key. Note: this does NOT reset the App Signing key, which remains the same.

Last updated: August 13, 2026 — Fact-checked against Play Console UI and keytool documentation