What Java actually stores inside Keystore when generating Keys? When we use Keytool to generate a Keystore to store Private/Public keys, what Java actually stores inside the Keystore file ?

I have observed that Keytool asks for the keypass and alias to generate the key, the alias can be used to retrieve any key from the keystore given that correct keypass is provided.

So, what actually stores inside a keystore file ?

1) an actual key ? 
or
2)  the pair of keypass and alias, and the key is generated using that keypass/alias ?

What I think is, the keypass and alias are stored in the keystore and key is generated if correct data is provided, am I correct ? , If not, and Raw key is stored inside a keystore then what is the need of keypass at first place ?

For your convenience, here is more detail about keytool,


  Java Keytool is a key and certificate management utility. It allows
  users to manage their own public/private key pairs and certificates.
  It also allows users to cache certificates. Java Keytool stores the
  keys and certificates in what is called a keystore. By default the
  Java keystore is implemented as a file. It protects private keys with
  a password. A Keytool keystore contains the private key and any
  certificates necessary to complete a chain of trust and establish the
  trustworthiness of the primary certificate.


Parameters of keytool command

Keystore Parameters

genseckey
Generate SecretKey. This is the flag indicating the creation of a synchronous key which will become our AES key

keystore
Location of the keystore. If the keystore does not exist, the tool will create a new store. Paths can be relative or absolute but must be local

storetype
this is the type of store (JCE, PK12, JCEKS, etc). JCEKS is used to store symmetric keys (AES) not contained within a certificate.

storepass
password related to the keystore. Highly recommended to create a strong passphrase for the keystore

Key Parameters

keyalg
algorithm used to create the key (AES/DES/etc)

keysize
size of the key (128, 192, 256, etc)

alias
alias given to the newly created key in which to reference when using the key

keypass
password protecting the use of the key
Nitpick: keytool accepts both alias and keypass if specified; if not specified it prompts for key password if needed but defaults alias to mykey. A JCEKS file can be operated on either by keytool or by other code. 
JCEKS can support three types of entries: privateKey, trustedCert, and secretKey (the older and default JKS file can do the first two).

The operations and algorithms you ask about are "symmetric" (not "synchronous") and use a "secret" key NOT "public" and "private" keys which apply to algorithms like RSA, DSA, ECC.
Also symmetric keys including AES are NEVER in certificates.

A secretKey entry contains the secretkey encrypted using the keypassword (using a PBE aka key-stretching algorithm). The password itself is not stored, which would be totally insecure, and instead must be provided on any attempt to access the privatekey. Note that you can change the alias of a secretkey entry and/or re-encrypt with a different keypassword without changing the key.