How to Get Your SHA-1 and SHA-256 Fingerprint (keytool, Firebase)

A fingerprint is a hash value derived from the certificate that signs your app; it proves which certificate produced a given package. Every keystore/alias pair for an Android app produces its own fingerprint — the same app signed with a different keystore yields a different SHA-1.

This value is most commonly needed in three places: when adding an Android app in the Firebase console (for features like Google Sign-In, Phone Authentication, App Check), when restricting a Maps SDK for Android API key by package name + SHA-1 in Google Cloud Console, and in the assetlinks.json file you host on your server for Android App Links auto-verification.

SHA-1 has long been requested for classic scenarios like Google Sign-In and Maps API key restriction; SHA-256 is required for App Links verification (assetlinks.json) and some newer Firebase features. The keytool -list -v command prints both in the same output, so one command covers whichever one you are asked for.

Android Studio and Flutter auto-generate a debug keystore for local development, and it ships with fixed details: it lives at ~/.android/debug.keystore on macOS/Linux, and at C:\Users\<YourUsername>\.android\debug.keystore on Windows; the alias is always androiddebugkey, and both the store and key password are android.

With those details, the command is: keytool -list -v -keystore ~/.android/debug.keystore -alias androiddebugkey -storepass android -keypass android. The output shows "SHA1:" and "SHA256:" lines, both formatted as colon-separated hex pairs.

This fingerprint only works for debug builds; the debug keystore is also machine-specific — every developer's and every CI machine's own debug.keystore produces a different SHA-1. If you work as a team, each member (and CI) needs to add their own debug SHA-1 to Firebase separately; this is the most common cause of "Google Sign-In works for me but not for my teammate."

If you already have a release or upload keystore (we cover how to create one with keytool in our other guide), the command has the same shape — just point it at your own file and alias: keytool -list -v -keystore /path/to/your/upload-keystore.jks -alias upload. It will prompt for the store password you set when you created the keystore.

You can read these details from your android/key.properties file (storeFile, keyAlias); entering the password interactively when prompted, rather than passing it on the command line, avoids leaving it in plain text in your shell history.

The SHA-1/SHA-256 this produces belongs to your "upload key." If your app is enrolled in Play App Signing (mandatory for new apps since 2021), this value may NOT match the actual signature of the package distributed to users — the next section covers that.

With Play App Signing on, you sign the AAB with your own upload key, but Google Play re-signs the package with its own "app signing key" before distributing it to users. The result: the certificate on the actual app users download from the store does NOT match the SHA-1 you extract from your local upload keystore.

This is exactly the most common mistake: a developer adds the SHA-1 from their local upload keystore to Firebase, everything works on their own device and in internal test builds, but for real users who download from the Play Store, Google Sign-In or the Maps API silently fails — because the store package carries a different certificate.

Get the correct values from Play Console's Protected with Play > Play Store protection > Manage Play app signing screen, which lists two separate certificates: the "App signing key certificate" (the real signature users receive) and the "Upload key certificate." Both list their own SHA-1, SHA-256, and MD5 values on this screen.

The practical fix: Firebase lets you register more than one fingerprint per Android app. Add the debug keystore's SHA-1, the upload key's SHA-1, AND the app signing key's SHA-1 at the same time; that way local development, internal test builds distributed directly as an APK, and real installs from the Play Store all authenticate correctly.

Go to Firebase Console > Project settings (the gear icon) > "Your apps," find your Android app's card, go to the "SHA certificate fingerprints" field, add the SHA-1 or SHA-256 value from the keytool output, and save. You can add as many fingerprints as you need to the same app card.

When pasting, copy the keytool output exactly as printed (colon-separated hex pairs); Firebase accepts the value with or without colons, but retyping it by hand leaves room for transcription errors. For some SHA-dependent features like Google Sign-In or App Check, it is recommended to re-download the updated google-services.json file and drop it back into your project after adding a fingerprint.

Because Vibeloy Keystore Vault stores your keystore file and passwords end-to-end encrypted, it lets you view and copy your SHA-1/SHA-256 values with one click from the vault, without hunting for the file path and password every time you need keytool. This is a premium Vibeloy feature.