Java KeyStore (JKS / JCEKS)
| Format | Java KeyStore (JKS / JCEKS) |
|---|---|
| Short name | JKS |
| Category | database |
| Platforms | Windows, macOS, Linux |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-05 |
Forensic relevance
Key and certificate containers of the Java platform. Entries carry an alias and a creation date in cleartext; certificates are stored unencrypted, while private and secret keys are protected with an entry password (JKS uses a proprietary SHA-1/XOR scheme, JCEKS a stronger password-based encryption). The whole store ends with a keyed SHA-1 digest derived from the store password. Since Java 9 the default keystore type is PKCS#12, which has no fixed signature.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | FE ED FE ED | .... | JKS magic 0xFEEDFEED |
| offset 0 (0x0) | CE CE CE CE | .... | JCEKS magic 0xCECECECE |
Known extensions
.jks, .keystore, .jceks, .ks
References
- JavaKeyStore.java (OpenJDK source) https://github.com/openjdk/jdk/blob/master/src/java.base/share/classes/sun/security/provider/JavaKeyStore.java
- JceKeyStore.java (OpenJDK source) https://github.com/openjdk/jdk/blob/master/src/java.base/share/classes/com/sun/crypto/provider/JceKeyStore.java
Cite this entry
Crush Format Reference, “Java KeyStore (JKS / JCEKS)”. https://kalink0.github.io/crush-forensics/formats/jks/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction