Skip to content

Most visited

Recently visited

Results for

navigation

apksigner

The apksigner tool, available in revision 24.0.3 and higher of the Android SDK Build Tools, allows you to sign APKs and to confirm that an APK's signature will be verified successfully on all versions of the Android platform supported by those APKs. This page presents a short guide for using the tool and serves as a reference for the different command-line options that the tool supports. For a more complete description of how the apksigner tool is used for signing your APKs, see the Signing Your Application guide.

Caution: If you sign your APK using apksigner and make further changes to the APK, the APK's signature is invalidated. Therefore, you must use tools such as zipalign before signing your APK.

Usage

Sign an APK

The syntax for signing an APK using the apksigner tool is as follows: 

apksigner sign --ks keystore.jks |
  --key key.pk8 --cert cert.x509.pem
  [signer_options] app-name.apk

When you sign an APK using the apksigner tool, you must provide the signer's private key and certificate. You can include this information in two different ways:

Usually, you sign an APK using only one signer. In the event that you need to sign an APK using multiple signers, use the --next-signer option to separate the set of general options to apply to each signer: 

apksigner sign [signer_1_options] --next-signer [signer_2_options] app-name.apk

Verify the signature of an APK

The syntax for confirming that an APK's signature will be verified successfully on supported platforms is as follows: 

apksigner verify [options] app-name.apk

Options

The following lists include the set of options for each command that the apksigner tool supports.

Sign command

General options

The following options specify basic settings to apply to a signer:

--out <apk-filename>
The location where you'd like to save the signed APK. If this option isn't provided explicitly, the APK package is signed in-place, overwriting the input APK file.
--min-sdk-version <integer>
The lowest Android framework API level that apksigner uses to confirm that the APK's signature will be verified. Higher values allow the tool to use stronger security parameters when signing the app but limit the APK's availability to devices running more recent versions of Android. By default, apksigner uses the value of the minSdkVersion attribute from the app's manifest file.
--max-sdk-version <integer>
The highest Android framework API level that apksigner uses to confirm that the APK's signature will be verified. By default, the tool uses the highest possible API level.
--v1-signing-enabled <true | false>
Determines whether apksigner signs the given APK package using the traditional, JAR-based signing scheme. By default, the tool uses the values of --min-sdk-version and --max-sdk-version to decide when to apply this signature scheme.
--v2-signing-enabled <true | false>
Determines whether apksigner signs the given APK package using the APK Signature Scheme v2. By default, the tool uses the values of --min-sdk-version and --max-sdk-version to decide when to apply this signature scheme.
-v, --verbose
Use the verbose output mode.

Per-signer options

The following options specify the configuration of a particular signer. These options aren't necessary if you sign your app using only one signer.

--next-signer <signer-options>
Used for specifying different general options for each signer.
--v1-signer-name <basename>
The base name for the files that comprise the JAR-based signature for the current signer. By default, apksigner uses the key alias of the KeyStore or the basename of the key file for this signer.

Key and certificate options

The following options specify the signer's private key and certificate:

--ks <filename>
The signer's private key and certificate chain reside in the given Java-based KeyStore file. If the filename is set to "NONE", the KeyStore containing the key and certificate doesn't need a file specified, which is the case for some PKCS #11 KeyStores.
--ks-key-alias <alias>
The name of the alias that represents the signer's private key and certificate data within the KeyStore. If the KeyStore associated with the signer contains multiple keys, you must specify this option.
--ks-pass <input-format>

The password for the KeyStore that contains the signer's private key and certificate. You must provide a password to open a KeyStore. The apksigner tool supports the following formats:

  • pass:<password> – Password provided inline with the rest of the apksigner sign command.
  • env:<name> – Password is stored in the given environment variable.
  • file:<filename> – Password is stored as a single line in the given file.
  • stdin – Password is provided as a single line in the standard input stream. This is the default behavior for --ks-pass.

Note: If you include multiple passwords in the same file, specify them on separate lines. The apksigner tool associates passwords with an APK's signers based on the order in which you specify the signers. If you've provided two passwords for a signer, apksigner interprets the first password as the KeyStore password and the second one as the key password.

--key-pass <input-format>

The password for the signer's private key, which is needed if the private key is password-protected. The apksigner tool supports the following formats:

  • pass:<password> – Password provided inline with the rest of the apksigner sign command.
  • env:<name> – Password is stored in the given environment variable.
  • file:<filename> – Password is stored as a single line in the given file.
  • stdin – Password is provided as a single line in the standard input stream. This is the default behavior for --key-pass.

Note: If you include multiple passwords in the same file, specify them on separate lines. The apksigner tool associates passwords with an APK's signers based on the order in which you specify the signers. If you've provided two passwords for a signer, apksigner interprets the first password as the KeyStore password and the second one as the key password.

--ks-type <algorithm>
The type or algorithm associated with the KeyStore that contains the signer's private key and certificate. By default, apksigner uses the type defined as the keystore.type constant in the Security properties file.
--ks-provider-name <name>
The name of the JCA Provider to use when requesting the signer's KeyStore implementation. By default, apksigner uses the highest-priority provider.
--ks-provider-class <class-name>
The fully-qualified class name of the JCA Provider to use when requesting the signer's KeyStore implementation. This option serves as an alternative for --ks-provider-name. By default, apksigner uses the provider specified with the --ks-provider-name option.
--ks-provider-arg <value>
A string value to pass in as the argument for the constructor of the JCA Provider class; the class itself is defined with the --ks-provider-class option. By default, apksigner uses the class's 0-argument constructor.
--key <filename>
The name of the file that contains the signer's private key. This file must use the PKCS #8 DER format. If the key is password-protected, apksigner prompts for the password using standard input unless you specify a different kind of input format using the --key-pass option.
--cert <filename>
The name of the file that contains the signer's certificate chain. This file must use the X.509 PEM or DER format.

Verify command

--print-certs
Show information about the APK's signing certificates.
--min-sdk-version <integer>
The lowest Android framework API level that apksigner uses to confirm that the APK's signature will be verified. Higher values allow the tool to use stronger security parameters when signing the app but limit the APK's availability to devices running more recent versions of Android. By default, apksigner uses the value of the minSdkVersion attribute from the app's manifest file.
--max-sdk-version <integer>
The highest Android framework API level that apksigner uses to confirm that the APK's signature will be verified. By default, the tool uses the highest possible API level.
-v, --verbose
Use the verbose output mode.
-Werr
Treat warnings as errors.

Examples

Sign an APK

Sign an APK using release.jks, which is the only key in the KeyStore: 

$ apksigner sign --ks release.jks app.apk

Sign an APK using a private key and certificate, stored as separate files: 

$ apksigner sign --key release.pk8 --cert release.x509.pem app.apk

Sign an APK using two keys: 

$ apksigner sign --ks first-release-key.jks --next-signer --ks second-release-key.jks app.apk

Verify the signature of an APK

Check whether the APK's signatures are expected to be confirmed as valid on all Android platforms that the APK supports: 

$ apksigner verify app.apk

Check whether the APK's signatures are expected to be confirmed as valid on Android 4.0.3 (API level 15) and higher: 

$ apksigner verify --min-sdk-version 15 app.apk
This site uses cookies to store your preferences for site-specific language and display options.

Get the latest Android developer news and tips that will help you find success on Google Play.

* Required Fields

Hooray!

Browse this site in ?

You requested a page in , but your language preference for this site is .

Would you like to change your language preference and browse this site in ? If you want to change your language preference later, use the language menu at the bottom of each page.

This class requires API level or higher

This doc is hidden because your selected API level for the documentation is . You can change the documentation API level with the selector above the left navigation.

For more information about specifying the API level your app requires, read Supporting Different Platform Versions.

Take a one-minute survey?
Help us improve Android tools and documentation.
Sure No thanks