# How to Change the mkcert Default Password "changeit" for PKCS12 Files

> Learn how to change the default mkcert PKCS12 password 'changeit' by editing source code and rebuilding. Secure your certificate bundles effectively.

- Repository: [Filippo Valsorda/mkcert](https://github.com/FiloSottile/mkcert)
- Tags: how-to-guide
- Published: 2026-03-05

---

**The mkcert tool hardcodes the legacy password `"changeit"` for both PKCS12 certificate bundles and Java keystore operations, requiring you to edit the source code in [`cert.go`](https://github.com/FiloSottile/mkcert/blob/main/cert.go) and [`truststore_java.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_java.go) and rebuild the binary to use a custom password.**

When generating PKCS12 (`.p12`) files with the `--pkcs12` flag or installing certificates into Java truststores, the popular TLS development tool **mkcert** (FiloSottile/mkcert) uses a default password that dates back to early Java conventions. Understanding where this password is embedded and how to modify it is essential for security-conscious development workflows or environments with strict password policies.

## Where the Default Password "changeit" Is Defined

The password `"changeit"` appears in two critical locations within the mkcert codebase, both chosen for backward compatibility with legacy tools that expect this historic default.

### PKCS12 Bundle Generation in cert.go

In **[`cert.go`](https://github.com/FiloSottile/mkcert/blob/main/cert.go)**, the `pkcs12.Encode` function creates the PKCS12 bundle when you use the `--pkcs12` option. The source explicitly passes `"changeit"` as the final argument to encode the private key and certificate chain:

```go
pfxData, err := pkcs12.Encode(rand.Reader, priv, domainCert,
    []*x509.Certificate{m.caCert}, "changeit")

```

This line (approximately line 25) hardcodes the password directly into the bundle generation call, meaning every `.p12` file produced by the standard mkcert binary uses this identical passphrase.

### Java Keystore Operations in truststore_java.go

In **[`truststore_java.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_java.go)**, mkcert manages the Java `cacerts` keystore for system-wide trust installation. The password is defined as a constant string variable around line 28:

```go
storePass string = "changeit"

```

This variable feeds into `keytool` commands via the `-storepass` flag when installing or removing certificates from the Java truststore, ensuring compatibility with default Java keystore configurations.

## How to Change the mkcert PKCS12 Password

Because mkcert does not expose command-line flags for password customization, you must modify the source and compile a custom binary. Follow these steps to implement a secure, custom password:

1. **Clone the repository** and navigate to the source root.

2. **Modify [`cert.go`](https://github.com/FiloSottile/mkcert/blob/main/cert.go)** (around line 25) to replace `"changeit"` with your desired password string variable.

3. **Update [`truststore_java.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_java.go)** (around line 28) to change the `storePass` constant to match your new password (or set a different one for Java operations).

4. **Rebuild the binary** using Go:

```bash
go build -o mkcert .

```

5. **Verify** the new binary generates PKCS12 files with your custom password by inspecting the output with OpenSSL:

```bash
openssl pkcs12 -in test.p12 -info -noout

```

## Code Examples for Modifying the Password

Here are the specific code changes required in each file to replace the default `"changeit"` with a custom password such as `"mySecretPwd123"`.

### Updating cert.go

Change the hardcoded string in the `pkcs12.Encode` call:

```go
// Before (default behavior)
pfxData, err := pkcs12.Encode(rand.Reader, priv, domainCert,
    []*x509.Certificate{m.caCert}, "changeit")

// After (custom password)
customPass := "mySecretPwd123"
pfxData, err := pkcs12.Encode(rand.Reader, priv, domainCert,
    []*x509.Certificate{m.caCert}, customPass)

```

### Updating truststore_java.go

Replace the `storePass` constant definition:

```go
// Before (default behavior)
storePass string = "changeit"

// After (custom password)
storePass string = "mySecretPwd123"

```

Both files must be saved before running `go build` to ensure consistency across PKCS12 generation and Java keystore operations.

## Important Considerations

Changing the default password affects only future certificate operations. **Existing `.p12` files** generated with the original mkcert binary still use `"changeit"` as their password. To secure previously created bundles, you must either regenerate them with your custom mkcert build or use OpenSSL to re-export them with new encryption.

Additionally, if you distribute your custom mkcert binary to team members, ensure everyone updates simultaneously when working with shared Java keystores, as mismatched passwords between the tool and existing keystores will cause `keytool` authentication failures.

## Summary

- **mkcert** hardcodes `"changeit"` as the password in [`cert.go`](https://github.com/FiloSottile/mkcert/blob/main/cert.go) for PKCS12 bundles and in [`truststore_java.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_java.go) for Java keystore operations.
- The password is passed directly to `pkcs12.Encode()` and the `keytool -storepass` flag for legacy compatibility.
- To use a custom password, edit the source code in both files and rebuild with `go build`.
- Existing certificates retain the original password and require regeneration to update.

## Frequently Asked Questions

### Why does mkcert use "changeit" as the default password?

The password `"changeit"` is the historic default for Java keystores and many legacy certificate tools. mkcert maintains this default to ensure seamless integration with older Java applications and development environments that expect this specific passphrase when importing certificates.

### Can I change the PKCS12 password without rebuilding mkcert?

No. Because the password is hardcoded as a string literal in the source files rather than exposed as a configuration flag or environment variable, you must modify [`cert.go`](https://github.com/FiloSottile/mkcert/blob/main/cert.go) and [`truststore_java.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_java.go) and compile a new binary to use a different password for PKCS12 generation.

### Will changing the password break my existing Java keystore installations?

Changing the password in your mkcert binary does not automatically update existing Java keystores that were already configured with the old password. If you previously installed certificates using `"changeit"`, your new binary may fail to remove or update those entries unless you manually specify the original password or reset the keystore entirely.

### Does mkcert support different passwords for PKCS12 files versus Java keystores?

Yes. While the default implementation uses `"changeit"` for both, you can set different values when modifying the source. In [`cert.go`](https://github.com/FiloSottile/mkcert/blob/main/cert.go), set one password variable for `pkcs12.Encode()`, and in [`truststore_java.go`](https://github.com/FiloSottile/mkcert/blob/main/truststore_java.go), set a different value for the `storePass` constant, allowing independent passwords for certificate bundles versus Java truststore operations.