JetBrains plugin signing: what it guarantees and what it does not

JetBrains plugin signing is designed to show that a plugin was not modified between publishing and delivery. Authors sign the distribution file, JetBrains Marketplace signs it again, and the IDE warns you if a plugin is unsigned or its certificate has been revoked. It does not tell you the plugin is safe to run.

How signing works

The JetBrains plugin documentation says signing was introduced in the 2021.2 release cycle. The sequence:

1. The plugin author signs the distribution file during the build.
2. Marketplace verifies the signature against the public key in the uploader's profile.
3. Marketplace signs the file again, so each file carries two signatures.
4. The IDE verifies using JetBrains' certificate authority, which is in the IDE's Java TrustStore.

What you see as a user

If a plugin is unsigned or its certificate has been revoked, the IDE shows a warning dialog during installation. Read it. Do not click through by habit.

What it guarantees

The documentation frames the goal as showing that the plugin was not changed between publishing and delivery. That addresses tampering in transit, such as a modified file served from a mirror.

What it does not guarantee

Signing proves integrity and origin of the file. It says nothing about intent or quality. A signed plugin from a malicious or compromised author is still signed. Think of it like HTTPS for the file, not a code review.

So you still need to judge the publisher, read reviews and keep the plugin list short.

Custom repositories

For custom plugin repositories, Marketplace does not re-sign. The IDE checks the signature against the JetBrains CA or against public keys you add under Settings, Plugins, Manage Plugin Certificates. A trusted TrustStore can also be set with the intellij.plugins.truststore system property, added in 2021.2.1.

This matters for organisations running an internal repository. Sign your internal plugins and distribute the public key so IDEs can verify them.

Practical advice

• Install from JetBrains Marketplace by default.
• Investigate any unsigned warning before proceeding.
• If you must install from disk, get the file from the author's official release page.
• Record installed plugins in your extension inventory.

An analogy that helps

Signing is like a tamper seal on a package. A broken seal tells you something happened after it left the sender. An intact seal tells you the contents are what the sender packed, which says nothing about whether you should trust the sender. The IDE checks the seal. You still decide about the sender.

For plugin authors and internal teams

If you build plugins for your own organisation, sign them in your build and publish the public key to your developers. Without that, the IDE will warn on installation, and people will learn to dismiss the warning, which weakens the signal for every other plugin. A clean internal signing story keeps the warning meaningful.

Quick check

Sources

• Plugin Signing, IntelliJ Platform Plugin SDK

Last reviewed: 19 October 2026.