Lost Android Keystore? Here's How to Reset Your Upload Key and Update Your Live App

So it happened — your app is already live on the Google Play Store, real users have it installed, and now you need to push an update. But you've lost the keystore file, forgotten the password, or simply can't find it anywhere. Panic sets in because you assume your app is stuck forever on its current version.

Take a breath. In most cases, this is completely fixable, and you won't need to publish your app as a new listing or lose your existing users, reviews, or install count. This guide walks you through exactly what a lost Android keystore means, why it happens, and the step-by-step process to regenerate a new key and get back to publishing updates.

Why You Can't Just "Regenerate" the Same Keystore

Before jumping into the fix, it's important to understand one hard truth: you cannot recreate the exact same keystore file once it's lost. A keystore is built from unique private key material generated at creation time — there's no password reset option and no way to reverse-engineer the original file. If someone tells you they can "recover" your exact old keystore, that's not accurate.

The good news is that you don't actually need the same file back. You just need Google to accept a new one going forward — and that's exactly what Google Play App Signing was built to allow.

App Signing Key vs. Upload Key: What's the Difference?

This distinction is the whole reason recovery is possible, so it's worth understanding clearly:

  • App Signing Key — This is the master key Google uses to sign the final APK/AAB that actually reaches your users' devices. If your app is enrolled in Play App Signing, Google securely stores and manages this key for you.
  • Upload Key — This is the key you use locally to sign your build before uploading it to the Play Console. Google verifies your upload using this key, then re-signs the app with the app signing key before distributing it to users.

Because Google holds the app signing key on its end, losing your local upload key isn't catastrophic — you can request that Google accept a new upload key going forward, without ever touching the key that actually signs what your users receive.

Step 1: Confirm Your App Is Enrolled in Play App Signing

This entire recovery path only works if Play App Signing is enabled. Most apps published in the last several years are automatically enrolled, but confirm it before doing anything else:

  1. Log in to Google Play Console using the account owner login (admin or editor roles won't have access to this option).
  2. Select your app from the dashboard.
  3. Go to Setup → App integrity.
  4. Check the App signing tab and confirm Play App Signing is active.

If Play App Signing is not enabled and you've lost your original signing key, your options are much more limited — you may need to contact Google Play support directly to explain the situation, since there's no separate upload key to reset in that case.

Step 2: Generate a Brand New Keystore File

Open your terminal (macOS/Linux) or Command Prompt (Windows) and run:


keytool -genkeypair -v -keystore new-upload-key.jks -alias upload -keyalg RSA -keysize 2048 -validity 10000

You'll be prompted to set a keystore password, your name/organization details, and a key password. Write these down and store them somewhere secure — a password manager, an encrypted backup, or a secure company vault. This is the mistake that got you here in the first place, so don't repeat it.

Step 3: Export the Public Certificate (.pem file)

Google doesn't need your private keystore file — only the public certificate extracted from it. Run:


keytool -export -rfc -keystore new-upload-key.jks -alias upload -file upload_certificate.pem

This creates an upload_certificate.pem file. This is the only file you'll upload to Google in the next step — never share your .jks file itself with anyone, since it contains private key material.

Step 4: Request an Upload Key Reset in Play Console

  1. Go back to Google Play Console → Setup → App integrity → App signing tab.
  2. Scroll down to the section called "Request upload key reset."
  3. Select the reason that matches your situation — typically "I lost my upload key" or "I forgot my keystore password."
  4. Upload the upload_certificate.pem file you just generated.
  5. Review your request and submit it.

If you don't see the "Request upload key reset" option at all, double-check that you're logged in as the account owner — this option is hidden for admin and editor roles.

Step 5: Wait for Google's Confirmation

Google reviews these requests manually for security reasons. Processing time varies — sometimes a few hours, sometimes up to 48–72 hours. You'll get:

  1. An immediate confirmation email acknowledging your request.
  2. A follow-up email once it's approved, specifying the exact date and time your new upload key becomes active.

Important: You cannot use the new keystore to sign and upload a build until the effective date mentioned in that email has passed. Trying earlier will simply result in an upload error.

Step 6: Update Your Build Configuration

Once your new upload key is active, point your project to the new keystore:

  • If you're using Android Studio's Generate Signed Bundle wizard, just select the new .jks file and enter the new credentials when signing your next release.
  • If you're using Gradle, update your key.properties file (or signing config block in build.gradle) with the new keystore path, password, alias, and key password.

Example key.properties:


storeFile=new-upload-key.jks
storePassword=YOUR_NEW_STORE_PASSWORD
keyAlias=upload
keyPassword=YOUR_NEW_KEY_PASSWORD

Step 7: Build, Sign, and Upload Your New Release

With everything configured, build your release APK or AAB as usual and upload it through the Play Console like any normal update. Because Play App Signing handles the actual signing that reaches users, your existing app listing, reviews, ratings, and install base stay completely intact — nothing changes from your users' perspective.

What If Play App Signing Was Never Enabled?

If your app predates Play App Signing and you never opted in, there's no separate upload key — your original keystore is your signing key, and there's no reset mechanism for it. In this situation:

  1. Contact Google Play Console support directly through the Help section and explain that you've lost your original app signing key.
  2. Be prepared to provide proof of ownership (developer account details, app package name, previous release history).
  3. In rare cases where support can't help, the only remaining option is publishing the app as a new listing under a new package name — which does mean starting over with reviews and install counts.

This is exactly why Google strongly recommends enrolling in Play App Signing for every app today.

How to Avoid This Ever Happening Again

Once you're back up and running, take a few minutes to keystore-proof your future self:

  • Store your keystore file and passwords in at least two separate secure locations (password manager + encrypted cloud backup).
  • Never keep the keystore only on one developer's personal laptop — store it somewhere your whole team can access if needed.
  • Document the keystore alias, store password, and key password together, but keep that documentation encrypted.
  • Consider adding your keystore backup process to your team's official release checklist.

Frequently Asked Questions

Can I recover my exact old keystore password? No. Java keystores don't support password recovery or resets. If you've genuinely lost the password, your only path forward is generating a new upload key and requesting a reset through Play Console.

Will resetting my upload key affect my existing app or users? No. As long as Play App Signing is enabled, Google continues signing delivered apps with the same app signing key. Your existing users, reviews, and install history remain completely unaffected.

How long does Google take to approve an upload key reset? It varies, but most requests are processed within a few hours to 48–72 hours. You'll receive an email confirming the exact activation date for your new key.

What if I'm not the account owner of the Play Console? The upload key reset option is only visible to the account owner. If you're an admin or editor, you'll need to ask the account owner to submit the request or grant you owner access.

Happy coding!