It should be a simple question to answer, but it isn’t. I’ll explain why, and the correct answer(s) today.
The Backstory
The answer is difficult to come to, because of litigation with Oracle, the interplay between Java and Android hasn’t been exactly the easiest road. I’ll try not to dive too deep on that subject, but it appears Google has won the day.
Basically, in as little time as possible – Android does not use Java as a specification. But it does use elements of Java as a language, which Google reworked into Dalvik… which later became known as the Android Runtime, or ART.
As a result of this ambiguity (Oracle asserted that it could copyright Java the language – not just the specification and standard), Google couldn’t exactly make its own Java interpreter. Google used (and largely took over) the since-discontinued Apache Harmony project, but only managed to get it stable inside of Android itself – for the purposes of executing compiled/finished Android apps.
That was a problem for people who needed to build apps, say, on a Mac or PC. As a result, to build Android applications, you have had to use Oracle’s Java Development Kit, or JDK.
Regardless of if you’re using Android Studio, or Eclipse which preceded it, the JDK is used to handle Java language processing, before the app is converted to Dalvik bytecode.
What’s Happening Today?
One olive branch that Google has committed to, is migrating to the OpenJDK for Android uses. But this is still a work in progress.
As a result, there are numerous correct answers to what JDK you should use. For the most secure daily-use system, you probably will want to use either Oracle JDK 8 or OpenJDK 8. This is particularly because Oracle is no longer offering security updates publicly for Oracle JDK 7 or JDK 6.
But Should I Use Oracle JDK 7?
Probably. That is Google’s current recommendation, as of Android Studio 2.1, which marks the first final Android N SDK release. Using Oracle JDK 7 will provide you will the most compatibility, albeit with reduced security if you are also using the accompanying JRE.
Update: Couple people wrote in that Android N SDK versions will mandate JDK 8, at which point OpenJDK will work. Considering most developers target Lollipop and KitKat – JDK 7 probably is still best, as it was the SDK version targeting those JDKs. Android-19 and Android-21 are still the dominant API targets in active devices today.
If you do use JDK 7, you should disable the JRE that it comes with in all web browsers. It is no longer security supported and may leave you vulnerable online. Also, keep in mind that on-device Java apps might load up the same JRE.
For maximum security, you should install both Oracle JDK 7 and JDK 8, and then update your PATH definition back to JDK 8 once you are done using Android Studio (or Eclipse). But this is very tedious to do, so it isn’t suggested elsewhere by Google, etc.
Another tactic that works for many developers is using OpenJDK 8, and then falling back to Oracle JDK 7 if they run into crashes that aren’t easy to debug. But as you can tell, this is a fluid topic – my hope is future Android Studio versions bundle OpenJDK inside of it, much like Qt apps often include a binded Qt runtime.
Will my app be less secure?
Highly unlikely to impossible. This is mostly about the security of your workstation and the stability of Android Studio.
Compiled apps execute inside the Android Runtime, not the Oracle JDK/JRE. As a result, you won’t improve security for users by stepping up to the latest JDK. It’s mostly about the security and performance of your build environment.
What about building AOSP, the Android OS itself?
Totally different question. Android OS building doesn’t involve on-device compilation and testing, and as result, works just fine with OpenJDK.
As of Android Lollipop, the OpenJDK 7 (or OpenJDK 1.7), should be used… and OpenJDK 1.8 as of Marshmallow (and presumably, Android N when it ships). Console, Inc. has an excellent build guide that goes more in-depth than Google’s build guide.
If you haven’t guessed, this is a problem for people (like me) that run both. More modern AOSP versions do check to make sure you’re not using the Oracle JDK anymore, but the Android Studio won’t. Toggling between the two on Linux is at least easy to do.
On OS X however, it’s a royal pain, which is one reason why most don’t build AOSP on Mac anymore. Also, building AOSP on Mac has been broken dating back to OS X Yosemite, and involves using archaic Xcode versions, and other hacks. Dear Google – please fix this!
A Brighter Future
Switching to OpenJDK 1.8 (the open-source equivalent to Oracle JDK 8) is a top priority for Google. And it may work just fine, depending on your app’s complexity or specific API calls. But it isn’t ready for Google to make it the default recommendation… yet.
Why doesn’t Google just post an article like this one?
You would have to ask them. I don’t work for or speak for Google. I would presume that it is due to ongoing litigation with Oracle, that Google is hesitant to put this matter in such plain English.