1. Introduction

After developing and testing an Android application, the next step is to prepare it for distribution.

Android Studio allows developers to generate two important release files:

• APK (Android Package Kit): An installable Android application package.

• AAB (Android App Bundle): A publishing format that Google Play uses to generate optimized APKs for different devices.

Before distributing an Android application, you must digitally sign its release package.

In this tutorial, we will learn how to create a keystore, generate a signed APK, generate a signed AAB, and securely manage the signing credentials.

2. What Is an APK?

APK stands for Android Package Kit.

It is the package format used to install Android applications on compatible devices.

An APK contains application components such as:

• Compiled Java and Kotlin code.

• Android resources.

• Application assets.

• Manifest information.

• Native libraries, when required.

• Digital signature information.

When Do We Use APK?

An APK is useful when:

• You want to install an application directly on an Android phone.

• You want to share an application for testing.

• You distribute an application outside Google Play.

• You need an installable package for a compatible app distribution platform.

Example:

MyApplication-release.apk

You can install a compatible APK on an Android device after allowing installation from the relevant source, when required.

3. What Is an Android App Bundle (AAB)?

Android App Bundle is a publishing format used to distribute Android applications through Google Play.

An AAB contains the compiled application code and resources. Google Play uses it to generate optimized APKs for users' devices.

For example, different devices may require different:

• Screen density resources.

• Language resources.

• CPU architecture libraries.

• Device-specific application components.

Google Play can deliver the resources and APK components required by a particular device.

Example:

MyApplication-release.aab

Why Is AAB Important?

• Supports Google Play's optimized delivery system.

• Can reduce the amount of data users need to download.

• Supports dynamic feature delivery.

• Allows Google Play to generate device-specific APKs.

Important: An AAB is not directly installable on an Android phone like a normal APK. It is generally uploaded to Google Play, which generates the APKs for distribution.

4. Difference Between APK and AAB

APK

• Installable application package.

• Useful for direct installation and testing.

• Can be shared through compatible distribution channels.

• Contains the APK resources and code needed for installation.

AAB

• Publishing format.

• Primarily used for Google Play distribution.

• Google Play generates optimized APKs.

• Cannot be installed directly by tapping the AAB file.

For new applications distributed through Google Play, Android App Bundle is the standard publishing format.

5. What Is App Signing?

App signing is the process of digitally signing an Android application using a cryptographic private key.

Android requires APKs to be digitally signed before they can be installed.

Signing helps establish the application's identity and verify that updates come from an authorized signing identity.

For Google Play distribution, developers sign the uploaded app bundle with an upload key. Google Play App Signing then manages the app signing key used to sign APKs delivered to users.

Why Is Signing Required?

• Helps verify application authenticity.

• Protects the integrity of application packages.

• Supports secure application updates.

• Establishes the signing identity of an application.

Without a valid signing configuration, you cannot generate the signed release artifact required for distribution.

6. What Is a Keystore?

A keystore is a file that stores cryptographic keys and certificates used for application signing.

Android Studio can create a keystore file with the .jks extension.

Example:

release-key.jks

A keystore contains information such as:

• Private key.

• Public certificate.

• Key alias.

• Key-related metadata.

The keystore and its passwords must be protected.

Important Keystore Information

Key Store Path: The location where your keystore file is saved.

Key Store Password: Protects access to the keystore.

Key Alias: Identifies the signing key inside the keystore.

Key Password: Protects the selected private key.

Validity: The period for which the certificate is valid. Choose a sufficiently long validity period, such as 25 years or more, for a long-lived application signing identity.

Never share your keystore file or passwords publicly.

7. Create a New Android Studio Project

First, we will create a small Android application for generating signed release files.

Follow these steps:

1. Open Android Studio.

2. Select New Project.

3. Choose Empty Views Activity.

4. Enter the project name:

ReleaseBuildApp

1. Select Java as the programming language.

2. Choose the minimum SDK required by your project.

3. Click Finish.

4. Wait for Gradle synchronization to complete.

You can also use an existing Android project instead of creating a new one.

8. Understand Application ID and Version Information

Before generating a release package, check your application's identity and version information.

Open the app-level Gradle file.

For a Groovy-based build.gradle file, an example configuration is:

android {

    namespace 'com.example.releasebuildapp'

    defaultConfig {

        applicationId 'com.example.releasebuildapp'

        minSdk 23

        targetSdk 35

        versionCode 1

        versionName '1.0'

    }
}

This is an illustrative configuration. Use SDK versions supported by your installed Android SDK and the current Google Play requirements when publishing.

Understanding Important Properties

applicationId: The unique identifier of your application.

minSdk: The minimum Android API level supported by your application.

targetSdk: The Android API level your application targets.

versionCode: An integer used to identify application releases. Increase it for every new Play Store release.

versionName: The user-visible version name, such as 1.0 or 1.1.

For future updates, do not reuse an already published versionCode.

9. Generate a Signed APK in Android Studio

Now we will generate our first signed APK.

Step 1: Open the Build Menu

Open your Android Studio project.

From the top menu, select:

Build > Generate Signed Bundle / APK

A dialog box will appear.

Step 2: Select APK

You will see two options:

Android App Bundle
APK

Select:

APK

Click Next.

Step 3: Create a New Keystore

In the signing configuration screen, you will see options such as:

• Key store path

• Key store password

• Key alias

• Key password

Click:

Create new...

A New Key Store window will open.

Step 4: Enter Keystore Information

Provide the following information:

Key Store Path:

Choose a safe folder on your computer.

Example:

D:\AndroidKeys\release-key.jks

Password:

Create a strong, unique keystore password.

Confirm Password:

Enter the same password again.

Key Alias:

Example:

releasekey

Key Password:

Create a strong password for the key.

Validity:

Choose a sufficiently long validity period, such as 25 years or more.

Certificate Information:

Enter the requested certificate details.

Click OK after completing the fields.

Your keystore file and signing key will be created.

Step 5: Select the Keystore

Return to the signing configuration screen.

Enter or verify:

• Keystore path.

• Keystore password.

• Key alias.

• Key password.

Click Next.

Step 6: Select Release Build

In the next screen, configure the build.

Select:

Build Variant: release

Choose your destination folder.

If Android Studio provides signature version options for APK generation, select the schemes appropriate for your supported Android versions.

For most modern applications, APK Signature Scheme v2 or newer is important. Keep compatibility requirements in mind when selecting signature schemes.

Click Create or Finish, depending on the Android Studio version.

Step 7: Wait for the Build

Android Studio will start generating your signed APK.

Wait until the build completes successfully.

You should receive a notification indicating that the APK has been generated.

Click Locate to open the output folder.

Example output:

app/release/app-release.apk

Your signed APK is now ready for testing or distribution.

10. Generate a Signed Android App Bundle (AAB)

Now we will generate the AAB file for Google Play distribution.

Step 1: Open the Signing Wizard

In Android Studio, select:

Build > Generate Signed Bundle / APK

Step 2: Select Android App Bundle

Select:

Android App Bundle

Click Next.

Step 3: Select Your Keystore

Use the keystore that you created in the previous section.

Enter:

• Keystore path.

• Keystore password.

• Key alias.

• Key password.

You should use the same appropriate upload key for subsequent uploads of the same Play Store application.

Step 4: Select Release Configuration

Select the release build variant.

Choose the destination folder.

Check the selected module and product flavor if your project uses multiple modules or flavors.

Click Create or Finish.

Step 5: Wait for AAB Generation

Android Studio will compile and sign the app bundle.

After successful generation, use the notification's Locate option.

The output file will look similar to:

app/release/app-release.aab

Your signed Android App Bundle is now ready for upload to Google Play Console.

11. Where Are APK and AAB Files Stored?

Android Studio normally stores generated release files inside the app module's build output directory.

APK Output

app/build/outputs/apk/release/

Example:

app-release.apk

AAB Output

app/build/outputs/bundle/release/

Example:

app-release.aab

The exact output location can differ depending on your module, product flavor, build configuration, and selected destination folder.

Use Android Studio's Locate option to find the exact file.

12. Test Your Signed APK

Generating an APK is not the final step. You should verify that the release application installs and works correctly.

Follow these steps:

1. Locate your generated signed APK.

2. Transfer it to an Android device.

3. Allow installation from the relevant source if Android requests it.

4. Install the APK.

5. Open the application.

6. Test important application features.

Check the following:

• Does the application open successfully?

• Are all screens displayed correctly?

• Do buttons work?

• Does database functionality work?

• Do network requests work?

• Are permissions handled correctly?

• Does the application crash?

You should also test the release build on an emulator or physical device before distribution.

Important: A debug build working correctly does not guarantee that the release build will work correctly. Test the actual release artifact.

13. How to Verify APK Signing

You can use the Android SDK's apksigner tool to verify an APK signature.

Example command:

apksigner verify --verbose --print-certs app-release.apk

If the signature is valid, the tool reports successful verification and displays certificate information.

The exact command may require the full path to apksigner from your Android SDK Build Tools directory.

For an Android App Bundle, you can inspect its signature using Java's jarsigner:

jarsigner -verify -verbose -certs app-release.aab

Do not use apksigner to sign an AAB. APKs and app bundles have different signing workflows.

14. Understanding Google Play App Signing

Google Play App Signing is Google's application-signing service.

It manages the app signing key used to sign APKs delivered through Google Play.

Two important keys are involved:

A. App Signing Key

This key is used to sign APKs distributed to users.

Google Play protects and manages this key when you enroll in Play App Signing.

B. Upload Key

This is the key used by developers to sign the app bundle before uploading it to Google Play.

Google Play verifies the upload signature before accepting the uploaded release.

How the Process Works

1. Generate an upload keystore.

2. Sign your Android App Bundle using the upload key.

3. Upload the signed AAB to Google Play Console.

4. Google Play verifies the upload.

5. Google Play generates device-specific APKs.

6. Google Play signs the distributed APKs using the app signing key.

7. Users receive the appropriate application package.

For new applications, configure Play App Signing during the initial Play Console release process.

15. Important Keystore Security Best Practices

Your keystore is one of the most important files in your Android application project.

Follow these rules:

• Never upload your private keystore to a public GitHub repository.

• Never share your keystore passwords.

• Keep a secure backup of the keystore.

• Store backup copies in a protected location.

• Use a strong, unique password.

• Keep access limited to authorized developers.

• Never delete your original signing credentials without a verified recovery plan.

• Keep your upload key and app signing key separate when using Play App Signing.

If you lose your upload key, Google Play provides a process to reset it.

If you lose a private signing key used for direct APK distribution outside Play App Signing, recovering the ability to update existing installations can be much more difficult.

16. Common Errors While Generating Signed APK or AAB

Error 1: Keystore Password Incorrect

Cause: The entered keystore password is incorrect.

Solution: Verify the password and select the correct keystore file.

Error 2: Key Alias Not Found

Cause: The entered alias does not exist in the selected keystore.

Solution: Check the correct key alias.

Error 3: Gradle Build Failed

Cause: There may be a compilation error, dependency problem, SDK configuration issue, or Gradle synchronization problem.

Solution:

1. Open the Build window.

2. Read the first meaningful error message.

3. Fix the source code or configuration problem.

4. Sync Gradle.

5. Generate the release package again.

Error 4: APK Installation Failed

Possible causes:

• The APK is corrupted.

• The application conflicts with an installed package signed using a different key.

• The device does not meet the application's minimum SDK requirement.

• The package is incompatible with the device.

• The APK signature is invalid.

Solution: Verify the signature, device compatibility, and installed application's signing identity.

Error 5: AAB Cannot Be Installed Directly

Cause: An AAB is a publishing format, not a directly installable APK.

Solution: Upload it to Google Play or use bundletool to generate installable APKs for testing.

Error 6: App Update Rejected

Cause: The new application may have an incorrect package ID, an invalid versionCode, or a signing identity that does not match the existing release configuration.

Solution: Verify the application ID, increase versionCode, and use the correct upload key.

17. Practical Project Checklist

Before generating the final release package, verify these items:

Project Preparation

• Gradle synchronization completed.

• Application ID is correct.

• Version code is updated.

• Version name is correct.

• Release build compiles successfully.

Signing Preparation

• Keystore created or existing keystore selected.

• Keystore password verified.

• Key alias verified.

• Key password verified.

• Keystore backup created securely.

Release Generation

• Correct module selected.

• Release variant selected.

• APK or AAB format selected correctly.

• Build completed successfully.

• Output file located.

Final Testing

• Release application installed successfully.

• Important features tested.

• No unexpected crashes.

• APK signature verified where applicable.

• AAB prepared for Play Console upload.

18. Conclusion

Generating a signed APK or Android App Bundle is an important step in Android application development.

An APK is useful for direct installation and compatible distribution channels. An Android App Bundle is the standard publishing format for Google Play, which generates optimized APKs for different devices.

In this tutorial, we learned how to create a keystore, configure signing information, generate a signed APK, generate an AAB, verify signatures, and understand Google Play App Signing.

Remember that your keystore and private credentials must be protected carefully. Always test your release build before distributing your application.

19. Frequently Asked Questions

Q1. What is a signed APK?

A signed APK is an Android application package that has been digitally signed using a private signing key.

Q2. What is an AAB file?

An Android App Bundle is a publishing format that Google Play uses to generate optimized APKs for different devices.

Q3. Can I install an AAB file directly on my phone?

No. An AAB is not directly installable like an APK. You need to generate APKs from it using an appropriate tool or distribute it through Google Play.

Q4. What is a keystore file?

A keystore is a file containing cryptographic keys and certificates used to sign an Android application.

Q5. What is a key alias?

A key alias is the name used to identify a particular key inside a keystore.

Q6. Why should I keep my keystore safe?

Your signing credentials are important for maintaining the application's signing identity and releasing future updates.

Q7. What is Google Play App Signing?

It is Google's service for managing the app signing key and signing APKs distributed through Google Play.

Q8. Where are signed APK files stored?

The default release APK output directory is generally app/build/outputs/apk/release/.

Q9. Where are AAB files stored?

The default release bundle output directory is generally app/build/outputs/bundle/release/.

Q10. Can I generate both APK and AAB from the same project?

Yes. Android Studio allows you to generate both formats from the same Android project using the signed build wizard.