Android Generate Keysotre Key Command Line

If a code signer does not yet have a suitable private key for signing the code, the key must first be generated, along with a corresponding public key that can be used by the code receiver's runtime system to verify the signature.

Using the Android Keystore API. To understand the Android Keystore API, you must first understand that encrypting secrets requires both public key and symmetric cryptography. In public key cryptography, data can be encrypted with one key and decrypted with the other key. In symmetric cryptography, the same key is used to encrypt and decrypt the. Keytool will quickly generate a public/private key pair and store them in a keystore for you after you answer a few simple questions. Keytool has a number of commands. The most common command used for signing Android builds -genkeypair, commonly abbreviated -genkey. The other commands may be useful to you, but uncommonly so.

Since this lesson assumes that you don't yet have such keys, you are going to create a keystore named examplestore and create an entry with a newly generated public/private key pair (with the public key in a certificate).

Type the following command in your command window to create a keystore named examplestore and to generate keys:

You will be prompted to enter passwords for the key and keystore.

Subparts of the keytool Command

Let's look at what each of the keytool subparts mean.

  • The command for generating keys is -genkey.
  • The -alias signFiles subpart indicates the alias to be used in the future to refer to the keystore entry containing the keys that will be generated.
  • The -keystore examplestore subpart indicates the name (and optionally path) of the keystore you are creating or already using.
  • The storepass value that you are promted for specifies the keystore password.
  • The keypass value that you are prompted for specifies a password for the private key about to be generated. You will always need this password in order to access the keystore entry containing that key. The entry doesn't have to have its own password. When you are prompted for the key password, you are given the option of letting it be the same as the keystore password.

Note: For security reasons you should not set your key or keystore passwords on the command line, because they can be intercepted more easily that way.

Distinguished-Name Information

If you use the preceding keystore command, you will be prompted for your distinguished-name information. Following are the prompts; the bold indicates what you should type.

Command Results

The keytool command creates the keystore named examplestore (if it doesn't already exist) in the same directory in which the command is executed. The command generates a public/private key pair for the entity whose distinguished name has a common name of Susan Jones and the organizational unit of Purchasing.

The command creates a self-signed certificate that includes the public key and the distinguished-name information. (The distinguished name you supply will be used as the 'subject' field in the certificate.) This certificate will be valid for 90 days, the default validity period if you don't specify a -validity option. The certificate is associated with the private key in a keystore entry referred to by the alias signFiles.

Self-signed certificates are useful for developing and testing an application. However, users are warned that the application is signed with an untrusted certificate and asked if they want to run the application. To provide users with more confidence to run your application, use a certificate issued by a recognized certificate authority.

Note: The command could be shorter if option defaults are accepted or you wish to be prompted for various values. Whenever you execute a keytool command, defaults are used for unspecified options that have default values, and you are prompted for any required values. For the genkey command, options with default values include alias (whose default is mykey), validity (90 days), and keystore (the file named .keystore in your home directory). Required values include dname, storepass, and keypass.

Note that this README is updated for the latest snapshot version. If you want to use the last release, please visit this page

Android Keystore Recovery

This project aims to solve the 'password forgotten' problem for (Android) developers who happen to manage java keystore(s).


This bruteforce tool is very simple, yet efficient. It will try all password combinations matching [A-Za-z0-9]+ by default, from the shortest password, up to the solution.

  1. Download the project jar
  2. Launch the bruteforce: java -jar android-keystore-recovery-1.4.0-bundle.jar <keystore> [opts]


These are the available options for AKR:

Generic options

  • -l <length> --min-length <length> start at given length
  • -f <password> --from <password> start at given password (in dictionary attack this is a start line number)
  • -t <password> --to <password> stop at given password (in dictionary attack this is a end line number)
  • -pps <number> --passwords-per-second <number> Will try the given number of passwords per second (Since 1.1)
  • -w <path> --wordlist <path> path to wordlist file (example: /../../wordlist.txt)

You can use --from and --to to parallelize the brute force on several computers.

Note: If you want to resume a stopped brute force, I suggest that you take the second last tried password that was stored in $HOME/AndroidKeystoreRecovery.log. Indeed, as actor computation is asynchronous, there is no guarantee that every password before the last one were really tried by the software.

### Character set options — since 1.1

Android Generate Keysotre Key Command Line Free

  • -lo --letters-only use letters only
  • -no --numbers-only use numbers only
  • -uc --upper-case discards lower-case letters
  • -lc --lower-case discards upper-case letters
  • -ec <chars> --extra-characters <chars> add specified characters in combinations

Time needed to retrieve password

Android Generate Keysotre Key Command Line

Bruteforce algorithms are not optimized at all, AKR is faster than other bruteforce tools but it will still try all password possibilities.

In our case, we try all the characters like so: A, B, ..., Z, a, b, ..., z, 0, ..., 9. This is 62 possibilites for one character of the password.

Depending on your hardware, AKR will try more or less passwords per second, this is a sample calculation with my own computer:

As you can see, brute force with a single computer can take a very long time...

You can use the -f (--from) and -t (--to) options to run AKR on different computers, to parallelize computation and try to shorten the discovery of the password.

Android Generate Keystore Key Command Line Online

Technical Information

This software runs on the Java Virtual Machine (JVM), so you need to have a Java Runtime Environnement (JRE) installed on your computer. If you don't have one, get it at

To benefit from multi-core computers, this software uses the awesome Akka actor library.


Android Generate Keysotre Key Command Line Download

  • Pull Requests: I accept every meaningful pull request that you might offer. Please add description and comments in the code :)
  • Issues: You can create issues, however, I don't know when I'll have time to fix them (will do my best!)


Copyright Romain Sertelon 2013

This software is licenced under the GNU Public Licence v3 (GPLv3), you can find it in the LICENCE file.