Resolve a signature conflict

When Android refuses to install an app with an error such as “App not installed” or “There was a problem parsing the package,” the most common cause is a signature conflict. The app you are trying to install is signed with a different key than the one already on your device. Android treats the signature as the app’s identity and will not allow an update to change that identity.

The rule is simple: an installed app can only be updated by a file signed with the same key. If the signing key differs, Android blocks the update, even if the package name is identical. This is a security boundary, not a bug.

Why Android enforces signature matching

Every Android app is signed with a certificate. The signing key is held by the developer who built the app. When you install an app, Android records the certificate. From that point on, any update must be signed by the same certificate (or a certificate in the same rotation chain, if the app uses signature scheme v3 key rotation). If the signing key does not match, the system refuses the update and shows an error such as “App not installed” or “Package installer keeps stopping.”

This is not a cosmetic rule. Android uses the signature to verify the identity of the publisher. If an app could be updated by a different key, an attacker who obtained that key, or who tricked you into installing a repackaged APK, could silently replace a legitimate app with a malicious version that inherits the original app’s permissions and data. The Android security model treats the signing certificate as the app’s identity, so a mismatched signature is treated as a different app. Android will not update an existing app with a different signature unless the original app is uninstalled first, and uninstalling removes its data.

Source: Android Developers, “Sign your app,” Android Developers documentation, 2024.

The practical question is not whether signature conflicts happen, they do, but how to resolve them without losing data, weakening security, or resorting to unsafe copies. The resolution is a decision rule: check the source, verify the signature, then decide whether to uninstall, update, or keep both versions.

Why a signature conflict happens

Every Android app is signed with a certificate. The signing key is held by the developer, and the certificate’s fingerprint is bound to the app’s package name. When you install a second APK or app bundle that carries the same package name but a different signing certificate, Android refuses to install it and reports a signature mismatch. This is a deliberate protection: it prevents an attacker from updating a legitimate app with a malicious version that reuses the same package name.

The signature conflict error appears in several forms:

“App not installed” with no further detail on some OEM builds.
“Package appears to be invalid” on newer Android versions.
“Signatures do not match” when installing over an existing app.
“INSTALL_FAILED_UPDATE_INCOMPATIBLE” when installing via ADB.

The most common cause is trying to update an app with a file signed by a different key. This happens when you download an APK from a site that repackages apps, or when a developer switches signing keys without a proper key rotation. Android treats a signature mismatch as a different app, even if the package name is identical.

What the signature actually proves

Android requires every APK and app bundle to be signed with a certificate before it can be installed. The signature is not a rating or a “trusted publisher” badge. It is a cryptographic property: the update must be signed with the same key as the installed app, otherwise Android refuses to install it. This is a hard rule, not a warning. The OS compares the new file’s signature against the existing app’s signature; if they do not match, the installation fails with “App not installed” or “Existing package by a different author” even if the file is otherwise valid.

The signing key is controlled by the developer. When you install an app, Android records the certificate that signed it. Any later update must be signed with the same certificate (or a certificate in the app’s key rotation chain if it uses Signature Scheme v3). This mechanism stops a malicious actor from taking over an installed app by pushing a fake update. It is not a statement about the developer’s identity; it only proves that the same key signed both versions. The Android Developers documentation describes this as “the signing certificate is the identity of the app” (Android Developers, 2024).

For an installed app, the Android package manager refuses to install an update whose signature does not match the signature of the currently installed version. The error appears as “App not installed” or “Package … signatures do not match.” This is the signature conflict. It is a security boundary: if the OS allowed a different key to update an existing app, an attacker who obtained a different key could replace a trusted app with a malicious one while preserving its data and permissions. Android enforces this by comparing the signing certificate of the installed app with the certificate of the incoming APK; if they do not match, the installation is rejected. The same rule applies whether the update comes from the Play Store, a sideloaded APK, or a device-management tool.

The decision rule for any signature conflict

Never try to “fix” a signature conflict by uninstalling the original app first. Uninstalling removes the original signature and data, and the replacement APK then installs as a new app. That is the only way to install an app with a different signature, and it is exactly why the system blocks the update. If you uninstall to bypass the conflict, you lose the app’s local data and any permissions granted to the original app. The correct path is to obtain the same version from the same publisher with the same signing key. If you cannot, you are not updating the app; you are installing a different app that happens to share the same package name.

How the package manager enforces the rule

The signature of an Android app is a cryptographic certificate, not a visual badge. When a developer signs an APK, they use a private key that corresponds to a public certificate. Android uses that certificate to decide whether an update is allowed to overwrite an existing app. If the certificate of the incoming APK does not match the certificate of the installed app, the system refuses the update even if the package name is identical. This is the “signature conflict” error. The signing key is not a username; it is a cryptographic identity. The practical consequence is that you cannot update an app from a different publisher without uninstalling the old version first, and even then, the new APK must be signed with a key the system accepts.

The signature mismatch error is one of the most common reasons an APK “won’t install” on Android. The system enforces this at the package manager level: an update must be signed with the same certificate as the installed app, or the install fails. This is not a Play Store rule; it is part of Android’s permission model. The same key that signed the original app must sign the update, otherwise Android refuses to replace it. If you attempt to install an APK from a different source over an existing app and get “App not installed” or “Signatures do not match,” the new file is either from a different developer, a re-signed copy, or an old version with a different key.

Why the OS rejects a mismatched signature

A signature conflict happens when the certificate that signed the incoming APK does not match the certificate of the installed app. Android enforces this at the package manager level. The system compares the signer certificate of the new file against the one stored for the existing package; if they do not match, the installation is rejected. The rejection is not a judgement about the new file being malicious; it is an integrity rule. The OS will not let one developer silently take over another developer’s app data or permissions. This is the core of the Android security model: the signature is the app’s identity, and the package name alone is not enough to prove ownership.

Common causes of signature conflicts

A developer switched signing keys without using Android’s key rotation (Signature Scheme v3), so the new APK has a different certificate.
An app was originally installed from one source (e.g., the Play Store) and the user tries to install the same app from the developer’s website, but the developer signs the website APK with a different key.
A user uninstalls the original app and then installs a “new” APK from an unofficial source; the signature is different, and the install fails or updates are blocked.
A developer uses a different signing key for a beta vs. stable build, and the user tries to update from one channel to another.
A device has two copies of the same package name from different signatures, and the OS refuses to update one over the other.