Fix 'Keystore Was Tampered With, or Password Was Incorrect' in Java

You’re seeing:

java.io.IOException: Keystore was tampered with, or password was incorrect

Or the longer stack trace:

java.io.IOException: Keystore was tampered with, or password was incorrect
    at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:780)
    at java.security.KeyStore.load(KeyStore.java:1445)
Caused by: java.security.UnrecoverableKeyException: Password verification failed

This error means Java can’t open the keystore file. Despite the scary “tampered with” wording, it’s almost always a password or format issue — not actual tampering.

Diagnostic Flowchart

Fastest Fix: Try These Passwords

# Try the default password
keytool -list -keystore yourfile.jks -storepass changeit

# Try empty password
keytool -list -keystore yourfile.jks -storepass ""

# Try common passwords
keytool -list -keystore yourfile.jks -storepass password
keytool -list -keystore yourfile.jks -storepass changeme

If none work, try specifying the correct store type (see Cause 2 below).

Cause 1: Wrong Password (Most Common)

You’re using the wrong password. The keystore was created with a different password than what you’re providing.

For cacerts (JDK trust store): The password is always changeit unless someone changed it.

keytool -list -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit

For application keystores: Check your application config, environment variables, or secrets manager for the correct password.

# Spring Boot — check application.properties/yml
grep -r "key-store-password\|trust-store-password" src/ config/

# Check environment variables
env | grep -i keystore
env | grep -i storepass

Cause 2: JKS vs PKCS12 Type Mismatch

You’re trying to open a PKCS12 file as JKS (or vice versa). Java defaults to JKS for older versions and PKCS12 for Java 9+.

Diagnose — check the file type:

# PKCS12 files start with specific bytes
file yourfile.p12
# Output: "data" (binary) — likely PKCS12

file yourfile.jks
# Output: "Java KeyStore" — definitely JKS

# Or try both types explicitly:
keytool -list -keystore yourfile -storetype PKCS12 -storepass yourpassword
keytool -list -keystore yourfile -storetype JKS -storepass yourpassword

Fix — specify the correct type:

# If it's PKCS12
keytool -list -keystore keystore.p12 -storetype PKCS12 -storepass password

# In Java code or JVM args
-Djavax.net.ssl.keyStoreType=PKCS12

In Spring Boot:

server.ssl.key-store-type=PKCS12
# or
server.ssl.key-store-type=JKS

Cause 3: Corrupted Keystore File

The file was truncated during copy, corrupted on disk, or partially written.

Diagnose:

# Check file size (0 bytes = definitely corrupted)
ls -la keystore.jks

# Try to list contents — if it fails with ANY password, file is likely corrupt
keytool -list -keystore keystore.jks -storepass changeit 2>&1

Fix: Restore from backup. If no backup exists, you’ll need to recreate the keystore and re-import certificates.

# Create a new keystore from your certificate files
openssl pkcs12 -export -in server.crt -inkey server.key -certfile chain.crt \
  -out new-keystore.p12 -name server -passout pass:newpassword

# Or create empty and import
keytool -genkeypair -alias temp -keystore new-keystore.jks -storepass newpassword -keyalg RSA
keytool -delete -alias temp -keystore new-keystore.jks -storepass newpassword
keytool -importcert -alias server -file server.crt -keystore new-keystore.jks -storepass newpassword

Cause 4: Wrong File Entirely

Your config points to the wrong file — maybe a certificate file (.crt/.pem) instead of a keystore (.jks/.p12).

# A PEM certificate is NOT a keystore
head -1 yourfile
# If it shows "-----BEGIN CERTIFICATE-----" — it's a PEM cert, not a keystore

# Convert PEM to PKCS12 keystore
openssl pkcs12 -export -in cert.pem -inkey key.pem -out keystore.p12 -passout pass:password

# Recreate trust store from system CAs
cp $JAVA_HOME/lib/security/cacerts new-truststore.jks
# Password is "changeit"

# Then add your custom CAs
keytool -importcert -alias my-ca -file my-ca.crt -keystore new-truststore.jks -storepass changeit -noprompt

keytool -storepasswd -keystore keystore.jks -storepass oldpassword -new newpassword

# Check magic bytes
xxd keystore | head -1
# JKS starts with: feed feed (hex: fe ed fe ed)
# PKCS12 starts with: 3082 (ASN.1 sequence)

# Or use file command
file keystore