Where Is the Android Debug Keystore Stored?
The Android debug keystore sits in a .android folder in your home directory. Every dev machine generates its own unless you share one.
Last updated
Android signs every build, including debug ones, and the throwaway key for that lives in a .android folder in your home directory. The IDE generates it silently on first run with a publicly known password. It exists so installs work, not so anything is secure.
Two machines hold two different debug keys, which is why a debug APK from a colleague refuses to install over yours. The fix is sharing one debug keystore file across the team. Guard release keys far more seriously: losing one ends the app's update history on the store.
Where Android SDK stores this, by platform
C:\Users\[Username]\.android\debug.keystore
Auto generated debug signing key with a public default password. Share one copy across team machines for consistent debug installs. Never use it for releases.
~/.android/debug.keystore
Same file and role as other platforms. The IDE creates it on first launch if missing.
~/.android/debug.keystore
Identical to macOS. CI runners generate their own unless you provision the shared file, which breaks update installs on test devices.
Frequently asked questions
How do I share debug signatures across a team?
Copy one debug.keystore to every machine and check it into a private team repo or secret store. Same file means same signature, and builds install as updates instead of conflicting installs.
Can I ship a release signed with the debug key?
No for anything public. The default password is public knowledge and the key identifies nobody. Release builds need a real keystore with a guarded password and a backup in two places.
Notice an outdated path? Let us know.