JKS to PFX / P12 / PEM
or drop your .jks / .keystore file anywhere on this page
or drop your .jks / .keystore file anywhere on this page
Open or drop the .jks/.keystore file, and enter the keystore password when asked.
Every alias in the store is listed — private-key entries with their certificate count, trusted entries as certificate-only. Click the one you want.
For a key alias: set a password and click "Create .pfx" or "Create .p12", or download its certificate chain and private key as PEM files.
For a trusted-certificate alias: download just that certificate as PEM — no key, no repacking.
Import the .pfx/.p12 into Windows/IIS/Azure, or point nginx/Apache at the PEM files.
Java keystores are where certificates go to get stuck: the .jks format is proprietary to Java, and every escape route in the manuals starts with installing a JDK to run keytool. This converter reads JKS natively in your browser — the Sun key-protection algorithm included — and hands you the standard formats everything else understands: a .pfx/.p12 archive or plain PEM files.
It also knows a modern trap: since Java 9 keytool creates PKCS#12 keystores by default while people still name them .jks. Files like that are detected and converted just the same. Either way, the keystore and the private key inside it are processed entirely on your device.
100% private“A keystore contains your private key, so where you unpack it matters. Decryption happens in this browser tab using WebCrypto — nothing is uploaded, and there is no server that could see the keystore or its password.”
Not at all. keytool has created PKCS#12 by default since Java 9 even when the file is named .jks. This page converts those too; the message is just telling you what the file really is.
This tool tries the password you enter for both roles, which covers the common case of them being identical. If your key uses a different password, change it first with keytool -keypasswd so they match, then convert.
Whichever you pick. Every alias is listed after unlocking: choose a private-key entry to build a .pfx/.p12 from that key and its chain, or a trusted-certificate entry to extract just that certificate. An all-certificates.pem download grabs everything at once.
You don’t need to know in advance. Selecting an alias shows the subject (CN), issuer and expiry date of every certificate inside it — so even keystores with aliases like "1" or "mykey" are easy to navigate. Click through the aliases until you see the name you’re after.
JCEKS uses a different (Triple-DES-based) key protection that is not supported in-browser. Convert it to PKCS#12 once with keytool -importkeystore -srcstoretype JCEKS -deststoretype PKCS12, after which no Java is needed again.