---
id: minikerberos
version: "0.4.9"
license: unclear
license_treatment: permissive
maintenance: aging
---

# minikerberos — Kerberos manipulation library in pure Python

License: permissive · Maintenance: aging · Downloads: 112.4K/mo

## What it is and what it does

Minikerberos is a pure-Python Kerberos client library designed for both programmatic use and pentesting. It implements the Kerberos protocol with support for multiple authentication methods—password-based, AES/RC4 keys, and PKINIT (certificate-based)—alongside both blocking and asynchronous client APIs. The library powers other security tools like pypykatz, aiosmb, and msldap, and ships with command-line utilities for common Kerberos operations.

For pentesters, it provides ready-to-use tools for TGT/TGS ticket fetching, kerberoast attacks, S4U2self/S4U2proxy delegation attacks, CCACHE file manipulation, and NT hash recovery. For developers, it offers a consistent API across sync and async contexts, making it suitable for integration into larger security frameworks or automation scripts.

Use it for:

- Perform kerberoast attacks to extract service account hashes for offline cracking.
- Request TGT and TGS tickets programmatically using password or certificate credentials.
- Exploit Kerberos Resource-based Constrained Delegation (RBCD) with S4U2proxy.
- Recover NT hashes from PKINIT certificate-based authentication.
- Convert and edit CCACHE files for ticket manipulation in penetration tests.
- Integrate Kerberos authentication into Python security tools or automation frameworks.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

A pure-Python Kerberos client library supporting password, certificate (PKINIT), and key-based authentication with both synchronous and asynchronous APIs.

Yes, if you need a pure-Python Kerberos client for pentesting or security research. The library is permissively licensed, has low install friction, and no known vulnerabilities. However, the 289-day gap between last commit and latest release suggests maintenance is infrequent—verify that its PKINIT and delegation features meet your current threat model before relying on it for production security work.

## Install

pip install minikerberos
uv add minikerberos
poetry add minikerberos

## Installing minikerberos

Before you install: Low friction installation with six runtime dependencies; last commit 2025-10-29 but no release in 289 days suggests the project is in a maintenance holding pattern rather than actively developed.

License in practice: MIT license (permissive) allows commercial and private use with minimal restrictions.

Quickstart:

pip install minikerberos

from minikerberos.client import KerberosClient
client = KerberosClient(target='user@REALM')
# Use client for TGT/TGS requests or kerberoast operations

Requires Python >= 3.6; depends on asn1crypto, oscrypto, asysocks, unicrypto, tqdm, and six.

Verify before relying:

- Whether the library's async API is production-ready or primarily for development/testing.
- Current compatibility with modern Windows certificate stores and PKINIT implementations.
- Whether the command-line tools (minikerberos-getTGT, minikerberos-kerberoast, etc.) are actively maintained for pentesting workflows.

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: aging
- Downloads: 112.4K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

kerberos client library python, kerberos authentication, pkinit certificate auth, kerberoast attack tool, spn ticket request, tgt tgs kerberos, s4u2self s4u2proxy delegation, kerberos-protocol, pentesting, authentication

[View on SkillFed](https://skillfed.io/packages/minikerberos) · [View on PyPI](https://pypi.org/project/minikerberos/)