How to sign an Android App Bundle (AAB) online for free
Google Play only accepts a signed Android App Bundle. If your CI or build tool outputs an unsigned `.aab`, you need to sign it with your upload keystore before you can upload to Play Console.
You can do that in Android Studio — or you can sign the AAB online in a few minutes with **Closed Test Pro AAB Signer**, a free open-source tool that runs `jarsigner` on ephemeral GitHub Actions runners.
Why you need to sign an AAB
Every App Bundle uploaded to Google Play must be signed with the private key that belongs to your app (your upload key, or the app signing key depending on your Play App Signing setup). An unsigned AAB is rejected.
Typical situations where an online signer helps:
- You already have an unsigned `.aab` from CI and do not want to install a JDK locally
- You need a quick re-sign for closed testing or a hotfix upload
- You want a transparent, auditable signing workflow instead of a black-box desktop tool
What Closed Test Pro AAB Signer does
**AAB Signer** is a free browser tool by Closed Test Pro:
- You upload an unsigned `.aab` and your keystore (`.jks`, `.keystore`, `.p12`, or `.pfx`)
- You enter the keystore password, key alias, and key password
- A public GitHub Actions workflow downloads the files, verifies the keystore, runs `jarsigner` with SHA256withRSA, verifies the signature, and uploads the signed artifact
- You download the signed AAB and upload it to Play Console
Temporary uploads are deleted after the job. Passwords are masked in Actions logs. The workflow source is public so you can audit every step.
Open the tool here: https://aab.closedtestpro.com
Step-by-step: sign your AAB online
1. Prepare your files
- Unsigned App Bundle: the `.aab` from your build (max 100 MB)
- Keystore: the same upload keystore you use for this app in Play Console
- Credentials: keystore password, key alias, and key password
2. Open Closed Test Pro AAB Signer
Go to aab.closedtestpro.com. No account is required.
3. Upload the bundle and keystore
Use the studio wizard:
- Bundle — choose your `.aab`
- Signing key — choose the keystore and enter alias + passwords
- Confirm — review filenames and start signing
4. Wait for jarsigner, then download
Signing usually finishes in a few minutes. When the job succeeds, download the signed AAB (delivered as a short-lived zip artifact) and upload it to your closed testing or production track in Play Console.
Security: what happens to your keystore?
Closed Test Pro designed the flow so sensitive files do not linger:
- Upload over HTTPS to temporary blob storage
- Signing runs on a throwaway GitHub Actions VM
- Workflow masks keystore and key passwords in logs
- Local runner files are scrubbed even if a step fails
- Blob uploads are deleted after the job completes or fails
- Signed artifacts expire after about 24 hours
You can verify this yourself by reading the public workflow and watching live Actions runs from the AAB Signer page.
jarsigner settings used
The workflow signs with the same algorithm family Google documents for App Bundles:
- Signature algorithm: SHA256withRSA
- Digest algorithm: SHA-256
- Tool: official jarsigner from Temurin JDK 17
That produces a standard signed AAB suitable for Play Console upload when you used the correct keystore.
After you sign: closed testing still matters
Signing gets your build into Play Console. New developer accounts still need 12 opted-in testers for 14 days of closed testing before production access.
Closed Test Pro helps with that next step:
- Find real Android developer testers
- Track daily opens
- Send reminders so streaks do not drop
Compare plans: Free, Pro & Premium →
FAQ
Start signing now
- Open **Closed Test Pro AAB Signer**
- Upload your unsigned AAB and keystore
- Download the signed bundle for Play Console