Skip to content

PKCS#12 / PFX Keystore Inspector

Open P12 and PFX keystores locally, verify password-based integrity, inventory keys and certificates, and inspect aliases and protection algorithms without exposing private-key bytes.

Open a PKCS#12 keystore

Choose a binary .p12 or .pfx file and enter its password. The worker verifies integrity before returning any inventory; private-key bytes are never included in the result.

The password is used in memory to verify the PFX MAC and decrypt supported safe contents. An empty password is valid for some keystores.

Keystore details

Keystore inventory will appear here

Open a PFX or P12 file to see integrity state, safe contents, certificate metadata, aliases, key links, and protection algorithms.

Inspect PFX and P12 contents without exporting private keys

DecodeLens verifies password-based PKCS#12 integrity, decrypts supported safe-content containers, maps aliases and localKeyId values, and parses embedded X.509 certificates. Private-key entries are reduced to metadata and are never placed in the UI result model.

PKCS#12 inspection boundaries

  • This route supports RFC 7292 PKCS#12 files commonly named .p12 or .pfx. JKS and JCEKS are proprietary Java formats and are not treated as aliases for PFX.
  • MAC or signed integrity verification establishes that the container was not modified under that mechanism; it does not establish certificate trust, hostname validity, or revocation state.
  • Public-key encrypted safe contents are not decrypted because the inspector does not accept or expose recipient private keys.
  • Legacy algorithms may be unavailable in current Web Crypto implementations. Unsupported algorithms fail explicitly rather than bypassing integrity or encryption.

Related tools for this workflow

Continue with tools that decode, convert, inspect, or verify the same data.

Review a PFX before importing it into a server or client

Choose the P12 or PFX file, enter its password, verify the integrity result, then review aliases, certificate validity, localKeyId relationships, private-key presence, and protection algorithms before importing the keystore elsewhere.

PFX / P12 file and password

client-identity.p12 · password

Verified inventory

Integrity verified · 1 certificate · 1 encrypted private key
Alias: client-identity · Protection: PBES2

PKCS#12 / PFX Inspector FAQ

Are PFX and P12 the same format?

They are commonly used filename extensions for PKCS#12 containers. This tool validates the binary structure instead of trusting the extension.

Does the inspector export the private key?

No. It reports that a private-key entry exists, whether it is encrypted, its alias, localKeyId, and protection algorithm. Raw private-key bytes are not returned to the workspace.

Does integrity verified mean the certificates are trusted?

No. It means the PFX integrity mechanism was verified. Certificate-chain trust, hostname checks, OCSP, CRL, and operating-system trust stores are separate checks.

Can this tool open JKS files?

No. JKS and JCEKS are separate Java keystore formats. Rename-based detection would be misleading, so this route accepts only PKCS#12/PFX structures.