Introduction

You can inspect an Android app and find the signing certificate that was used, but you generally cannot determine the exact keystore file from the APK alone. The APK contains certificate information, not a path back to the original .jks or .keystore file. In practice, you compare the app’s certificate fingerprint with the certificates in candidate keystores.

What the APK Actually Tells You

An APK carries signature data that lets Android verify integrity and update compatibility. From that signature, you can extract:

• the certificate subject
• the certificate validity range
• the SHA-1 and SHA-256 fingerprints
• the public key details

What you cannot extract is “this app came from /home/user/release.jks.” The keystore container and alias are local developer artifacts, not part of the APK metadata.

Inspect the APK Certificate

A standard way to inspect the certificate is apksigner.

apksigner verify --print-certs app-release.apk

Typical output includes certificate digests such as SHA-256. That fingerprint is the most useful identifier for comparison.

If apksigner is not available, you can also inspect signature files by unzipping the APK and using other certificate tools, but apksigner is the clearest Android-specific approach.

Compare Against a Candidate Keystore

Once you have the APK certificate fingerprint, inspect the keystore you suspect might have been used.

keytool -list -v -keystore release.jks

If the keystore contains multiple aliases, inspect each one until you find a certificate whose fingerprint matches the one reported by apksigner.

A matching SHA-256 fingerprint strongly indicates that the corresponding private key signed the app.

Matching Example

The workflow is:

1. extract the certificate fingerprint from the APK
2. list certificates in candidate keystore files
3. compare the fingerprints
4. confirm the alias whose certificate matches

That is as close as you can get to answering “which keystore was used” unless you already control the build system or signing records.

Play App Signing Changes the Picture

If the app was distributed through Google Play with Play App Signing enabled, the APK users download may be signed by the Play app signing key rather than by your local upload key. In that case, comparing against your local upload keystore may not match the distributed artifact even though your team still owns the app.

That distinction matters a lot in modern Android release pipelines. You may have:

• an upload key used to send artifacts to Play
• an app signing key managed for distribution

So when fingerprints do not match, the explanation may be Play App Signing rather than the wrong keystore candidate.

What If You Only Have One APK and No Candidate Keystores

Then you can identify the signing certificate, but not the keystore file itself. The best you can do is record the certificate fingerprints and compare them later against known keys, build logs, CI secrets, or Play Console signing information.

That is often enough for operational work, because update compatibility and publisher identity depend on the certificate, not on the filename of the keystore container.

Security Implications

A keystore is more than just a certificate store. It also protects the private key. That private key never appears inside the APK. If it did, the whole signing model would be broken.

So the inability to reconstruct the original keystore from the APK is not a tooling limitation in the usual sense. It is part of the security model.

Common Pitfalls

The biggest pitfall is expecting the APK to reveal the exact keystore file name or alias automatically. It cannot. You need a comparison against a known candidate keystore or a signing record.

Another mistake is comparing only certificate subject names. Subjects are less reliable than SHA-256 fingerprints and can be reused or look similar across keys.

Developers also forget about Play App Signing and compare the distributed APK only against the local upload key. That often leads to false conclusions.

Finally, do not confuse the public certificate with the private signing key. The APK exposes certificate information, not the secret material needed to sign updates.

Summary

• From an APK, you can identify the signing certificate, but not the exact original keystore file by name or path.
• Use apksigner verify --print-certs to inspect the app certificate.
• Use keytool -list -v -keystore to inspect candidate keystores and compare fingerprints.
• Match SHA-256 fingerprints rather than relying on certificate names alone.
• If Google Play App Signing is involved, the distributed app may be signed by a different key than your upload keystore.