Search code examples
androidkeystore

Why use debug.keystore?


I know the difference between a release keystore and the default debug.keystore, but why use the debug.keystore at all?

It is said debug.keystore is used during development but I don't see any advantages of that, only disadvantages. When integrating stuff like Facebook and Google Maps you need to generate a hash out of it.

Disadvantages:

  • You always need to add at least two hashes
  • Two different machines could have different debug.keystores I believe so my colleagues could have problems in the app when building the app themselves.

In my point of view you can always use the release keystore just fine during development.


Solution

  • There could be other reasons for using a debug keystore, but I'm just going to mention one that's security related:

    For some developers, the keystore used to sign production builds is a very sensitive piece of information. Keeping that information on their hard drive at all times, even if it's in an encrypted volume, could be undesirable. If your app is a game with a hundred users, having someone else obtaining your production keystore perhaps isn't the end of the world. But if your app is an online banking app with a million users, then having your keystore stolen suddenly becomes a pretty big deal.

    Going through the process of production-signing every test build might just be too much of a hassle, compared to signing the test builds with a debug key that can be kept on your development machines at all times.