JKS to PFX / PEM
or drop your .jks / .keystore file anywhere on this page
or drop your .jks / .keystore file anywhere on this page
Open or drop the .jks/.keystore file, and enter the keystore password when asked.
Check the chip: it shows the alias found, how many certificates, and whether a private key is inside.
Set a password for the new .pfx and click "Create .pfx" — or download certificates.pem / private-key.pem directly.
Import the .pfx into Windows/IIS/Azure, or point nginx/Apache at the PEM files.
Java keystores are where certificates go to get stuck: the .jks format is proprietary to Java, and every escape route in the manuals starts with installing a JDK to run keytool. This converter reads JKS natively in your browser — the Sun key-protection algorithm included — and hands you the standard formats everything else understands: a .pfx/.p12 archive or plain PEM files.
It also knows a modern trap: since Java 9 keytool creates PKCS#12 keystores by default while people still name them .jks. Files like that are detected and converted just the same. Either way, the keystore and the private key inside it are processed entirely on your device.
100% private“A keystore contains your private key, so where you unpack it matters. Decryption happens in this browser tab using WebCrypto — nothing is uploaded, and there is no server that could see the keystore or its password.”
Not at all. keytool has created PKCS#12 by default since Java 9 even when the file is named .jks. This page converts those too; the message is just telling you what the file really is.
This tool tries the password you enter for both roles, which covers the common case of them being identical. If your key uses a different password, change it first with keytool -keypasswd so they match, then convert.
JCEKS uses a different (Triple-DES-based) key protection that is not supported in-browser. Convert it to PKCS#12 once with keytool -importkeystore -srcstoretype JCEKS -deststoretype PKCS12, after which no Java is needed again.