Key Explorer downloads statistics

Key Explorer is a comprehensive, native cryptographic toolkit for developers, security engineers, and PKI administrators in IntelliJ IDEA. Inspect, edit, analyze, and convert certificates, keystores, private and public keys, and modern cryptographic structures directly within your IDE workflow.

Supported File Types & Formats

Key Explorer natively recognizes, auto-detects (via magic byte signatures, ASN.1 structure inspection, and PEM header heuristics), and inspects the following cryptographic types:

Category Type / Format Common Extensions Format / Specification Requires Password

Certificates X.509 Certificate (PEM) .pem, .crt, .cert Base64 ASCII (-----BEGIN CERTIFICATE-----) No

Certificates X.509 Certificate (DER) .der, .cer Binary ASN.1 / DER structure No

Certificates PKCS#7 / CMS Chain .p7b, .p7c, .spc Cryptographic Message Syntax (RFC 2315 / 5652) No

Certificates PKIPath Certificate Chain .pkipath ASN.1 PkiPath sequence No

Certificates Software Publisher Certificate .spc Microsoft Authenticode PKCS#7 format No

Certificates Serialized Certificate Store .sst Microsoft Serialized Certificate Store No

Certificates CA Certificates Bundle cacerts, *.crt Java default CA root truststore No

Certificates TLS/SSL Live Chain N/A (Remote host:port) Live X.509 TLS certificate chain No

Certificates Post-Quantum Certificate .pem, .der, .crt Pure PQC certificate (ML-DSA-44/65/87 (Dilithium), SLH-DSA / SPHINCS-256, Falcon, AIMer, FAEST, HAETAE, HAWK, Mayo, SDitH, SNOVA, UOV, SQIsign, LMS, XMSS) No

Certificates Hybrid / Composite Certificate .pem, .der, .crt Dual-algorithm (e.g. MLDSA87-Ed448, X-Wing MLKEM768-X25519-SHA3-256) No

KEM / Key Exchange Post-Quantum KEM & Hybrid .pem, .der, .key ML-KEM (512/768/1024), FrodoKEM, NewHope (NH), NTRU, NTRUPlus, NTRUPrime (SNTRUPRIME), Classic McEliece (CMCE), HQC, SABER No

Keystores PKCS#12 Keystore .p12, .pfx, .pkcs12 RSA PKCS#12 standard / RFC 7292 Yes

Keystores Java Keystore (JKS) .jks, .keystore Java Keystore (Magic: 0xFEEDFEED) Yes

Keystores JCEKS Credential Vault .jceks JCE Keystore with secret keys (Magic: 0xCECECECE) Yes

Keystores Bouncy Castle Keystore (BKS) .bks Bouncy Castle standard keystore (v1/v2) Yes

Keystores Bouncy Castle UBER .uber Heavily encrypted Bouncy Castle UBER store Yes

Keystores Hardware Security Module (PKCS#11) N/A (Device slot) Hardware tokens & SoftHSM slots via PKCS#11 Yes (PIN)

Private Keys PKCS#8 Private Key .key, .pk8, .pem ASN.1 PKCS#8 unencrypted (BEGIN PRIVATE KEY) No

Private Keys PKCS#8 Encrypted Key .key, .pk8, .pem Password-encrypted PKCS#8 (BEGIN ENCRYPTED PRIVATE KEY) Yes

Private Keys PKCS#1 RSA Private Key .key, .pem Traditional RSA key (BEGIN RSA PRIVATE KEY) No

Private Keys EC Private Key .key, .pem SEC1 Elliptic Curve key (BEGIN EC PRIVATE KEY) No

Private Keys DSA Private Key .key, .pem Traditional DSA key (BEGIN DSA PRIVATE KEY) No

Private Keys OpenSSL Encrypted Key .key, .pem Traditional key with Proc-Type: 4,ENCRYPTED Yes

Private Keys OpenSSH Private Key id_rsa, id_ed25519, *.key OpenSSH proprietary format (BEGIN OPENSSH PRIVATE KEY) Yes / No

Private Keys Microsoft PVK .pvk Microsoft Private Key format (Magic: 0x1EF1B5B0) Yes / No

Public Keys Public Key (PEM) .pub, .pem SubjectPublicKeyInfo SPKI (BEGIN PUBLIC KEY) No

Public Keys Public Key (DER) .der Binary ASN.1 SubjectPublicKeyInfo (SPKI) No

Public Keys OpenSSH Public Key .pub, authorized_keys OpenSSH single-line format (ssh-rsa, ssh-ed25519) No

Key Pairs Key Pair with Certificate (PEM) .pem Combined X.509 Certificate and unencrypted key No

Key Pairs Encrypted Key Pair (PEM) .pem Combined X.509 Certificate and encrypted key Yes

PKI Requests Certificate Signing Request (CSR) .csr, .req, .pem PKCS#10 PEM (BEGIN CERTIFICATE REQUEST) & DER No

PKI Revocation Certificate Revocation List (CRL) .crl, .pem X.509 CRL PEM (BEGIN X509 CRL) & DER No

MTC Merkle Tree Certificate .mtc, .mtccert, .pem Ultra-compact MTC (BEGIN MERKLE TREE CERTIFICATE) No

MTC MTC JSON & Log Manifests .json IETF MTC JSON & PLANTS batch logs (plants-06) No

IoT / Tokens CBOR / COSE Payloads .cbor, .cose, .cwt Concise Binary Object Representation / COSE / CWT No

Cloud Kubernetes TLS Secret .yaml, .json Kubernetes kubernetes.io/tls secret payload No

Cloud Kubernetes ConfigMap with Certs .yaml, .json Kubernetes ConfigMap containing certificate data No

Getting Started

You can start a 30-day free trial directly from Settings → Plugins → Installed → Key Explorer → Manage Licenses.

Trademarks & Third-Party Notices: Thales, Luna, SafeNet, and Chrystoki are trademarks or registered trademarks of Thales Group or its affiliates. SoftHSM is maintained by OpenDNSSEC / NLnet Labs. Let's Encrypt is a trademark of the Internet Security Research Group (ISRG). JetBrains, IntelliJ, and IntelliJ IDEA are trademarks or registered trademarks of JetBrains s.r.o. Key Explorer is an independent product developed by xkrypt and is not affiliated with, endorsed by, or sponsored by Thales Group or any other mentioned vendors.