KLIST(1) MIT Kerberos KLIST(1)

# [NAME](#NAME)

klist - list cached Kerberos tickets

# [SYNOPSIS](#SYNOPSIS)

**klist** \[**-e**] \[\[**-c**] \[**-l**] \[**-A**] \[**-f**] \[**-s**] \[**-a** \[**-n**]]] \[**-C**] \[**-k** \[**-i**] \[**-t**] \[**-K**]] \[**-V**] \[**-d**] \[*cache\_name*|*keytab\_name*]

# [DESCRIPTION](#DESCRIPTION)

klist lists the Kerberos principal and Kerberos tickets held in a credentials cache, or the keys held in a keytab file.

# [OPTIONS](#OPTIONS)

[**-e**](#e)

Displays the encryption types of the session key and the ticket for each credential in the credential cache, or each key in the keytab file.

[**-l**](#l)

If a cache collection is available, displays a table summarizing the caches present in the collection.

[**-A**](#A)

If a cache collection is available, displays the contents of all of the caches in the collection.

[**-c**](#c)

List tickets held in a credentials cache. This is the default if neither **-c** nor **-k** is specified.

[**-f**](#f)

Shows the flags present in the credentials, using the following abbreviations:

```
F    Forwardable
f    forwarded
P    Proxiable
p    proxy
D    postDateable
d    postdated
R    Renewable
I    Initial
i    invalid
H    Hardware authenticated
A    preAuthenticated
T    Transit policy checked
O    Okay as delegate
a    anonymous
```

[**-s**](#s)

Causes klist to run silently (produce no output). klist will exit with status 1 if the credentials cache cannot be read or is expired, and with status 0 otherwise.

[**-a**](#a)

Display list of addresses in credentials.

[**-n**](#n)

Show numeric addresses instead of reverse-resolving addresses.

[**-C**](#C)

List configuration data that has been stored in the credentials cache when klist encounters it. By default, configuration data is not listed.

[**-k**](#k)

List keys held in a keytab file.

[**-i**](#i)

In combination with **-k**, defaults to using the default client keytab instead of the default acceptor keytab, if no name is given.

[**-t**](#t)

Display the time entry timestamps for each keytab entry in the keytab file.

[**-K**](#K)

Display the value of the encryption key in each keytab entry in the keytab file.

[**-d**](#d)

Display the authdata types (if any) for each entry.

[**-V**](#V)

Display the Kerberos version number and exit.

If *cache\_name* or *keytab\_name* is not specified, klist will display the credentials in the default credentials cache or keytab file as appropriate. If the **KRB5CCNAME** environment variable is set, its value is used to locate the default ticket cache.

# [ENVIRONMENT](#ENVIRONMENT)

See *kerberos* for a description of Kerberos environment variables.

# [FILES](#FILES)

[**FILE:/tmp/krb5cc\_%{uid}**](#FILE:/tmp/krb5cc___uid_)

Default location of Kerberos 5 credentials cache

[**FILE:/etc/krb5.keytab**](#FILE:/etc/krb5.keytab)

Default location for the local host's keytab file.

# [SEE ALSO](#SEE_ALSO)

*kinit*, *kdestroy*, *kerberos*

# [AUTHOR](#AUTHOR)

MIT

# [COPYRIGHT](#COPYRIGHT)

1985-2026, MIT

1.22.2

---

Document: klist(1) from krb5 1.22.2-r5 (Chainguard OS)
Source: https://github.com/krb5/krb5.git