What the key is for
Android will not install an app that is not signed, and it will not install an update unless it is signed with the same key as the version already on the phone. Google Play adds a layer: you sign an upload key, Play holds the real app-signing key and re-signs for distribution. Either way, the key you create with this command is the identity of your app for its whole life. Lose it and you cannot update the app — only publish a new one with a new package name and start again from zero installs.
On the free tier every build is signed with a key the service manages for you, which is fine for installing and sharing APKs. Pro lets you upload your own keystore, so that the app on Google Play stays updatable by you, from any tool, forever.
The arguments, explained
| Argument | What it is | Advice |
|---|---|---|
-keystore | The file that holds the key | One keystore can hold several keys, but one per app is easier to back up and reason about. |
-alias | The key's name inside the file | Lower-case, no spaces. You will type it into the builder. |
-keyalg RSA -keysize 2048 | The algorithm | 2048 is what every Android tool expects; 4096 is fine and slightly slower to sign with. |
-validity | Days the certificate is valid | Google Play requires expiry after October 2033. 30 years (10,950 days) is the convention. |
-dname | Who owns the key | Only CN is required. Nothing here is verified or shown to users; it is what keytool would otherwise ask you interactively. |
After you run it
- Back it up immediately — the
.jksfile and the password, in two places that are not the same laptop. A password manager entry with the file attached is ideal. - Never commit it to a repository. Add
*.jksto.gitignorebefore you forget. - Upload it in the builder (Pro → Signing) and build. Every future build of that project is signed with it.
- If you enrol in Play App Signing (the default for new apps), this becomes your upload key. Play keeps the app-signing key; if you lose the upload key, Play can issue a new one — a much softer failure than losing the only key.