Has your signing key been leaked?
Paste a signing-certificate SHA-256 fingerprint. We check it against a corpus of keys found exposed in public repositories. Android app certificates today — more platforms coming.
Why a leaked signing key is catastrophic
App signing is the root of trust on mobile platforms. When the key behind it leaks, that trust breaks in ways a password reset never could.
What an app signing key does
Every app is signed with its publisher's private key. The signature proves the app genuinely comes from that publisher and hasn't been tampered with — operating systems, app stores and update mechanisms all rely on it to decide what is authentic. One key vouches for the origin and integrity of every build.
Why a leak is so severe
A signing key is not a password — it cannot simply be reset. The same key is trusted for years or decades. If it leaks, anyone can sign a malicious app that every device accepts as a genuine build from the real publisher, and the anti-fraud tooling that keys off the signature stops working. A signing-key leak is treated worldwide as an extreme-severity incident.
Counterfeit apps
Attackers forge the publisher's signature, so the OS treats a malicious build as authentic and bypasses platform security checks.
Anti-fraud bypass
Risk-control that tells official builds from repackaged ones by signature can no longer distinguish them — fraud clients slip through and drain funds.
Data & sandbox breach
Apps sharing a key share data and permissions. A forged app can break the sandbox and reach accounts, credentials and payment data.
Financial loss
Wearing the publisher's identity, an attacker can drive illegitimate transactions or unlock paid features — direct loss to business and users.
Reputation damage
A key leak is a global-scale security event; it signals weak security governance and erodes user and partner trust.
Recovery is brutally expensive
Because the key can't be quietly rotated, fixing a leak means a new key and re-signing — forcing every user to uninstall, reinstall and lose all local data. For a hypothetical 800-million-user app, even a 10% retention drop is ~80 million users lost; at a few dollars of acquisition cost each that alone is hundreds of millions — before fraud, breach and reputation losses. Which is why the key must never leak in the first place.
One lookup, growing to every key type
SignLeakDB starts with Android app signing certificates and is built to index any credential that leaks as a fingerprint. Here is what is live and what is next.
Android app signing
Keystore / JKS certificates — 43,111 indexedApple code signing
iOS / macOS provisioning & certificatesAuthenticode
Windows / driver code-signing certsGPG / PGP keys
Package & release signing keysSSH keys
Committed private host & user keysTLS private keys
Web-server certificates & keysHow the lookup works
Keystores store the signing certificate in cleartext — the fingerprint is public. No private key or password is ever needed, stored, or shown here.
Crawl public leaks
We continuously scan public repositories for credential files committed by accident, and extract each certificate's SHA-256 fingerprint.
Fingerprint, not secret
A certificate SHA-256 is the same value apksigner and app stores expose. Matching it proves a key is out there — without touching any private material.
Built for defence
This tool returns only "leaked or not" and how widely. It never reveals where to download a key, a password, or the private key itself.
Frequently asked
Where do I get my certificate SHA-256?
Run apksigner verify --print-certs your-app.apk and copy the "SHA-256" line, or keytool -list -v -keystore your.keystore. Google Play Console shows it under App integrity → App signing.
Is my hash sent to a server?
No. The whole index is downloaded once and the comparison happens locally in your browser. Your query never leaves your device.
My key shows as leaked — what now?
Treat it as compromised. Rotate the signing key, adopt Play App Signing / key rotation where possible, request takedown of the exposing repositories, and audit any release signed with it. Anyone can forge updates that the OS accepts as coming from you.
"Not found" means I'm safe?
It means your certificate is not in our current dataset of public leaks. It is not a guarantee — the key could be exposed elsewhere, or leaked after our snapshot. Absence of evidence is not evidence of absence.
Do you support other key types?
Today the dataset is Android app signing certificates. The lookup is fingerprint-based, so Apple code signing, Authenticode, GPG, SSH and TLS keys can be added the same way — see the Coverage section for the roadmap.