pCapitan — decrypt traffic with the Decryption Vault
Add certificates, private keys, key-logs, keytabs, Wi-Fi passwords or IPsec keys, and read the encrypted conversations.
Decryption uses the Wireshark engine, so install Wireshark first. The vault is on the 🔐 Encryption page.
Create and open the vault
- Choose an Admin password (at least 10 characters) and click Create the vault.
- As Admin you can also set a Captain password for a second person. Only the Admin and the Captain can open the vault; nobody else can, not even GizmoGoose.
- The vault locks itself after 15 minutes without use, and when pCapitan closes.
Add keys
Choose files, and type the File password if a .pfx / .p12 or private key needs one. The vault accepts:
- server private keys and certificates:
.pfx,.p12,.key,.pem,.crt,.cer,.der; - TLS key-log files (
SSLKEYLOGFILE) and TLS pre-shared keys; - Kerberos keytabs and SSH key-logs;
- Wi-Fi passwords (WPA2-Personal) with the network name;
- IPsec ESP keys (SPI, algorithms and keys).
pCapitan matches every key against the capture and says what it will do: ready, decrypted, blocked by forward secrecy or no match.
Why a server key is sometimes not enough
A server’s private key decrypts only connections that used RSA key exchange. Modern TLS (ECDHE, and every TLS 1.3 connection) uses temporary keys that never cross the network. For those you need a key-log file: set the SSLKEYLOGFILE environment variable before starting the browser or app, reproduce the traffic while capturing, then add the file.
Decrypt
Click Decrypt this capture. Conversations change from 🔒 Encrypted to 🔓 Decrypted, and Follow stream shows their content. Wi-Fi and IPsec traffic is written to a new, decrypted capture: click Open the decrypted capture.
Keys are sensitive: lock the vault when you are done, and remove keys you no longer need.
