Choose an APK (or AAB) and see how it is signed: the certificate owner, the SHA-1 and SHA-256 fingerprints you need for Firebase and Google Sign-In, the validity dates, and whether it uses v1, v2 or v3 signing. The file stays on your device.
Firebase and Google Sign-In ask for the SHA-1 (and SHA-256) fingerprint of the key your app is signed with. Google Maps API keys and Android App Links (assetlinks.json) use the same fingerprints. Facebook login uses the "key hash", which is the SHA-1 converted to base64 - it is shown too.
v1 signs the individual files inside the APK (the old JAR way). v2 signs the whole APK file and is required on Android 7 and newer. v3 adds support for rotating the signing key, and v3.1 improves that for Android 13 and newer. Most modern apps carry v1, v2 and v3 together.
If you use Play App Signing, Google re-signs the app delivered to users with its own app signing key. The APK you build and upload is signed with your upload key. Copy the app signing SHA-1 from Play Console (Setup, App signing) for Firebase and API keys, and add the upload key fingerprint as well.
A debug build is signed automatically with the standard Android debug key (CN=Android Debug). Such an app works for testing, but the Play Store does not accept it. The tool marks it so you notice before publishing.
No. It reads and shows the certificate stored in the file. To check that the file has not been changed since signing, use Google's apksigner tool: apksigner verify --print-certs app.apk.
No. Your browser reads only the end of the file (where the signature and the file list are kept) and a few small files, so even a 200 MB APK opens quickly and nothing leaves your device.