Lost Your Flutter Upload Key? Reset It in Play Console in 6 Steps (2026)

By giosaia (GSPTeck) · Published 2026-10-13 · Last verified 2026-10-13

The laptop died, the backup drive is blank, or nobody remembers the keystore password — and now Play Console rejects your next Flutter build. If your app uses Play App Signing, this is recoverable: you create a new upload key and ask Google to reset the old one, and your users keep getting updates to the same app. This is a solo developer’s step-by-step for that reset, plus the follow-up work people forget: CI secrets, Firebase fingerprints and a backup plan so it never happens twice. Based on Google’s and Flutter’s own docs, checked 2026-10-13; always re-read them on the day you submit.

First: which key did you actually lose?

Two columns: the upload key you keep, which signs uploaded bundles and can be reset, versus the app signing key Google holds, which is not changed by a reset
Which key did you lose?

Play App Signing uses two keys, and the difference decides whether this is an inconvenience or a disaster. Google’s Play Console help on using Play App Signing describes them like this:

Android’s app signing guide adds the key point: resetting the upload key does not affect the app signing key, so you can continue to publish updates to the original app. For apps that are not enrolled in Play App Signing, losing the signing key means losing the ability to update the app — Play’s help on publishing issues says you would have to publish a new app with a new package name. Check which situation you are in before anything else: in Play Console, open your app and look at the app signing page under Play Store protection. If it shows an app signing key managed by Google and a separate upload key certificate, you can reset.

Step 1: generate a new upload keystore

Create the new key on a machine you trust. Flutter’s Android release guide gives the command for macOS and Linux:

keytool -genkey -v -keystore ~/upload-keystore.jks -keyalg RSA \
  -storetype JKS -keysize 2048 -validity 10000 -alias upload

Use a strong, unique password and write down the alias. Play’s help says the upload key must be an RSA key of 2048 bits or more, which this command meets. Do not reuse the old file name in the same folder — you want it to be obvious which keystore is the new one.

Step 2: export the certificate as PEM

Four-step reset flow: generate a new upload keystore with keytool, export the certificate as PEM, request an upload key reset, upload the PEM and wait for approval
Reset in Play Console.

Google needs the public certificate of the new key, not the key itself. Play’s help gives the export command:

keytool -export -rfc -keystore upload-keystore.jks -alias upload -file upload_certificate.pem

The .pem file is safe to upload; the .jks file and its passwords are what you protect. Never attach the keystore itself to a support ticket.

Step 3: request the reset in Play Console

The path in Play’s help is: Protected with Play → Play Store protection → Manage Play app signing, then in the Upload key certificate section click Request upload key reset, enter the reason, upload upload_certificate.pem and click Request. A few practical notes:

Step 4: point your Flutter build at the new key

Grid of Flutter steps after a reset: update key.properties, keep it out of git, build an app bundle, upload to the internal track, confirm acceptance, promote
Flutter build after reset.

Flutter reads signing details from android/key.properties. Update it with the new values — storePassword, keyPassword, keyAlias=upload and storeFile pointing at the new keystore. Flutter’s docs warn to keep key.properties private and out of public source control. Then build a release bundle with flutter build appbundle and, once Play says the new key is active, upload it to an internal testing track first. If Play accepts it there, the reset worked; promote from internal testing as usual. Our guide to shipping Flutter and Firebase apps as an indie developer covers the rest of the release routine.

Step 5: update everything that knew the old key

This is where resets cause a second outage. List every place the old upload key or its fingerprints were used:

Grid of places to update after a key reset: CI secrets, Firebase SHA fingerprints, Android API key restrictions, App Links for locally signed builds, other build machines, deleting old secrets
Update what knew the old key.

Step 6: make sure it never happens again

  1. Store the keystore and its passwords in two separate places, such as an encrypted password manager entry and an offline encrypted backup.
  2. Write down the alias, the file name and where the backups live in your project notes — without the passwords.
  3. Test the backup: restore it on a different machine and sign a test build with it once a year.
  4. Keep 2-Step Verification on for every Play Console user, as Play’s help recommends.

Common mistakes during a reset

Vertical Pinterest graphic: lost your Flutter upload key, reset it in six steps
Pinterest pin: upload key reset.

FAQ

Will users have to reinstall the app?

No, if the app uses Play App Signing. The app signing key Google uses is unchanged, so updates install over the existing app.

What if my app is not enrolled in Play App Signing?

Then the key you lost is the signing key, and Play’s help says you cannot update that app. Contact Play support to confirm, and plan for a new listing if needed.

Can I reset the key if I only forgot the password?

From Google’s point of view, a keystore you cannot open is a lost key, so the same reset process applies.

Do I need Android Studio?

No. The keytool commands above come with the JDK; Android Studio is one way to run them.

Sources

More indie developer guides on the GSPTeck blog.