Convert Kerberos tickets between the kirbi (KRB-CRED) format used by Mimikatz and Rubeus and the ccache format used by Impacket and MIT Kerberos. The direction is detected automatically. No decryption is performed and everything runs in your browser.
Drop a .kirbi or .ccache file here, or click to select
The kirbi format is a DER-encoded KRB-CRED message (first byte 0x76), while ccache is the binary credential cache (first byte 0x05) read by tools that honour the KRB5CCNAME variable. Converting between them only re-packages the same encrypted tickets and session keys, so the result works with the same realm and services. This port follows Impacket's ticketConverter and is verified against its output byte-for-byte.
Convert Kerberos tickets between the kirbi (KRB-CRED) and ccache formats. Direction is auto-detected and everything runs in your browser.
Kerberos tickets are stored in two common formats. The kirbi format is a DER-encoded KRB-CRED message, produced and consumed by Windows tooling such as Mimikatz and Rubeus. The ccache format is the binary credential cache read by Linux and cross-platform tools that honour the KRB5CCNAME environment variable, including Impacket. This tool converts a ticket from one format to the other so the same credential can be used across both toolsets.
Input:
A .kirbi or .ccache file (upload, base64 or hex)
Output:
The same ticket in the other format, ready to download
Does this decrypt my ticket?
No. Conversion only re-packages the existing encrypted ticket and session key into the other container. The ticket remains usable against the same realm and services.
How is the direction chosen?
Automatically, from the first byte. A kirbi (KRB-CRED) starts with 0x76 and a ccache starts with 0x05, so you do not need to pick a mode.
Which tools use each format?
kirbi is used by Mimikatz and Rubeus on Windows. ccache is used by Impacket, the MIT Kerberos client and other tools that read the KRB5CCNAME variable on Linux and macOS.
Does my ticket leave the browser?
No. Parsing and conversion run entirely client-side, so the ticket and its session keys never leave your device.