Open your JKS & PKCS#12 keystores
Bare PEM files on disk are the exception. Java services, signing pipelines and load balancers keep their certificates in keystores — and a crypto inventory that skips them misses where production keys actually live.
How it works
- Open the Keystore tab and pick a
.jks,.p12or.pfxfile. - Type the password in the field on that tab — it’s used only there and never leaves your browser.
- Every key and certificate inside is inventoried: algorithm, key size, signature hash, validity.
- Sync the results into the same inventory as your other surfaces.
The keystore password never leaves your browser tab
The keystore is opened locally in the tab, in WebAssembly — the password and the private keys inside are never written out, logged or transmitted anywhere, not even to your own PQLens account.
What tends to hide in old keystores
Keystores accumulate: the 2016 intermediate CA somebody imported to fix a handshake, self-signed certs from a proof-of-concept, and RSA-1024 keys that predate the current team. Because the container is opaque, none of it shows up in a filesystem certificate scan — which is why keystores are their own surface.
Frequently asked questions
Which keystore formats are supported?
PKCS#12 (.p12 and .pfx) and Java KeyStore (.jks).
Is the keystore password sent anywhere?
No. The keystore is opened inside your browser tab and the password stays there — it is never transmitted, logged, or sent to your account.
Does PQLens extract or export the private keys?
No. It reads metadata — algorithms, key sizes, certificate details — to classify them. Key material never leaves the keystore.