A lot of the pen-testing toolkit that Kali ships with assumes a working Java runtime somewhere on the system. Burp Suite, ZAP, Ghidra, the older Nessus agents, and most JVM-based decompilers and reverse-engineering tools need at least a JRE to start, and many want a full JDK so they can compile plugins at runtime. The Metasploit Framework is another common consumer. This guide installs OpenJDK 21 (the current LTS line) on Kali Linux Rolling directly from the Kali apt repositories, with no third-party PPAs or tarball juggling.
Kali tracks Debian unstable so the packaged OpenJDK builds are consistently fresher than the Debian stable branch, and you usually get a security update within a day or two of upstream publishing one. The only catch is that the versions move, so the commands here resolve whatever’s current rather than hardcoding a number.
Verified working: April 2026 on Kali Linux Rolling 2026.1 with OpenJDK 21.0.11 from the kali-rolling main repo
Step 1: Refresh the package index
Kali rolls constantly. Run apt update first so you’re looking at today’s package versions, not whatever was current when you last touched the box:
sudo apt updateStep 2: Check what JDK versions are available
Kali packages every LTS line plus the current development branch. List all the headless JDK packages to see the choices:
apt-cache search '^openjdk-[0-9]+-jdk-headless$' | sortOn Kali 2026.1 the list includes Java 17 (previous LTS), Java 21 (current LTS), and the newer short-term development release. OpenJDK 21 is the right default for 99% of tools, so check its policy to see which version apt will actually install:
apt-cache policy openjdk-21-jdk-headlessThe Candidate line shows the version apt will install:
openjdk-21-jdk-headless:
Installed: (none)
Candidate: 21.0.11~8ea-1
Version table:
21.0.11~8ea-1 500
500 http://http.kali.org/kali kali-rolling/main amd64 PackagesStep 3: Install OpenJDK 21 and the CA certificates
The -headless package gets you the compiler and runtime without the AWT/Swing desktop dependencies. Most servers and CLI tools want the headless variant. Install it alongside ca-certificates-java so TLS connections from JVM processes use the system trust store:
sudo apt install -y openjdk-21-jdk-headless ca-certificates-javaIf you actually need the GUI components (Swing apps, JavaFX), skip the -headless suffix and install openjdk-21-jdk instead. It pulls in a few dozen extra packages for the X11 and font stack.
Step 4: Verify the runtime and compiler
Two quick sanity checks. First the JRE:
java -versionYou should see openjdk 21 reported along with the Debian build tag:
openjdk version "21.0.11-ea" 2026-04-21
OpenJDK Runtime Environment (build 21.0.11-ea+8-Debian-1)
OpenJDK 64-Bit Server VM (build 21.0.11-ea+8-Debian-1, mixed mode, sharing)Then the compiler:
javac -versionThe compiler version should match the JRE major number exactly:
javac 21.0.11-eaBoth should report the same 21.x version from the same Debian build. If java comes back as a different version, that’s the update-alternatives system pointing at a different JDK you installed earlier. Step 6 shows how to switch defaults.
Step 5: Set JAVA_HOME system-wide
Many JVM tools (Tomcat, Elasticsearch, Kafka, Gradle builds) refuse to start if JAVA_HOME is not set. Debian-family JDK packages install under /usr/lib/jvm/java-21-openjdk-amd64, and you can point JAVA_HOME there via a profile drop-in that applies to every login shell:
JAVA_PATH=$(readlink -f "$(which java)" | sed 's|/bin/java||')
echo "export JAVA_HOME=$JAVA_PATH" | sudo tee /etc/profile.d/jdk.sh
sudo chmod 644 /etc/profile.d/jdk.sh
source /etc/profile.d/jdk.sh
echo $JAVA_HOMEThe resolved path points at the current openjdk-21 install directory:
/usr/lib/jvm/java-21-openjdk-amd64The readlink -f trick means this works no matter which JDK version apt installs. If Kali pulls in a 21.0.12 update next week, JAVA_HOME still points at the right directory without any manual intervention.
Step 6: Switch between multiple JDKs
If you have more than one JDK installed (say Java 17 for an older tool and Java 21 as the default), Debian’s update-alternatives system manages the switch. List the registered candidates:
sudo update-alternatives --config javaThe command prints a numbered list and prompts you to pick a default:
Selection Path Priority Status
------------------------------------------------------------
* 0 /usr/lib/jvm/java-21-openjdk-amd64/bin/java 2111 auto mode
1 /usr/lib/jvm/java-17-openjdk-amd64/bin/java 1711 manual mode
2 /usr/lib/jvm/java-21-openjdk-amd64/bin/java 2111 manual mode
Press <enter> to keep the current choice[*], or type selection number:Run the same command with --config javac to change the compiler, and --config jar for the archive tool. Otherwise your java runtime and javac compiler may end up on different major versions and you’ll get cryptic UnsupportedClassVersionError messages at runtime.
Step 7: Compile and run a hello world
Final smoke test: write a tiny class, compile it, and run it from the compiled bytecode:
cat > /tmp/Hello.java <<'EOF'
public class Hello {
public static void main(String[] args) {
System.out.println("Hello from Java " + System.getProperty("java.version"));
}
}
EOF
cd /tmp && javac Hello.java && java HelloThe output confirms the JVM, compiler, and classpath are all wired up correctly:
Hello from Java 21.0.11-eaWrap up
OpenJDK 21 from the Kali repos is the cleanest option on Kali Linux. It updates with the rest of the system, the headless package is genuinely small, and update-alternatives makes running multiple versions side by side painless. Our dedicated reference on switching the default Java version covers the update-alternatives workflow in more depth. If you plan to build Java projects locally, add Apache Maven on top. If you need the matching headers to compile JNI extensions or DKMS modules next to your tooling, follow our Kali kernel headers guide. And if you want the full Burp Suite Professional experience after this, see our walkthrough on installing and using Burp Suite on Kali Linux, which assumes exactly this Java setup.
Thank you!
Welcome!!