SIGNING
Your key, your signature.
URL to App creates the Android signing key in your browser and signs the APK there. The private key never leaves the tab, but the backup is your responsibility.
The key is generated locally
The first Android build generates an RSA-2048 key with WebCrypto. The private key is imported as non-extractable, so JavaScript cannot read its raw bytes. It is stored in IndexedDB for later builds in the same browser profile.
A self-signed X.509 certificate is generated for the key, and the certificate plus the public key are stored alongside it. Android identifies an installed app by package name and signing certificate, not by the app label or icon.
The encrypted backup
Because the private key is non-extractable, the portable copy is a
.p1x file encrypted with PBKDF2-SHA256 and AES-GCM. The
backup password is the only thing that can unlock it. Keep the backup
and the password separate from the device.
If you lose the key and the backup, you cannot install a replacement over the old app. You would have to uninstall the old app first, which removes its local data.
The signature
The APK is signed with APK Signature Scheme v2 using the local key. The signature covers the APK contents and makes the package installable on Android without a Play Store account or a cloud signing service.
Every build currently writes version code 1. It is designed for a fresh sideload, not for automatic updates. Rebuilding with the same key lets Android replace the app; rebuilding with a different key does not.
Practical rules
- Download the
.p1xbackup on the first build and store it safely. - Reuse the same key for every rebuild of the same app.
- Do not publish these personal wrappers to Google Play.
- Treat the backup password as part of the key: losing it is the same as losing the key.
Read the signing and updates section of the README for the full details.