PEM ↔ DER Converter
Convert X.509 certificates and keys between PEM (Base64-encoded text with -----BEGIN----- markers) and DER (raw binary). Useful when a tool wants one format and you have the other.
How to use the PEM ↔ DER Converter
PEM → DER: paste the PEM, click Convert, download the resulting binary file. DER → PEM: select the binary file, pick the expected type (CERTIFICATE, PRIVATE KEY, etc.), get the PEM output ready to copy.
About PEM and DER
X.509 certificates and keys come in two encodings of the same underlying ASN.1 data:
- DER — Distinguished Encoding Rules. Compact binary. Default for Java keystores and Windows.
- PEM — Privacy Enhanced Mail. Base64 of the DER bytes, wrapped with
-----BEGIN X-----/-----END X-----markers. Default for OpenSSL, nginx, Apache, most Linux tools.
They round-trip losslessly — converting PEM to DER and back gives you the same DER bytes, and the same PEM modulo whitespace.
Frequently asked questions
What is the difference between PEM and DER?
DER is the raw binary encoding of a certificate or key. PEM is that same binary wrapped in Base64 with BEGIN and END header lines. The underlying bytes are identical.
When do I need DER instead of PEM?
Java keystores and some Windows and embedded tools expect DER, while OpenSSL and most web servers prefer PEM. Convert when a tool rejects the format you have.
Are my certificates or keys uploaded?
No. Conversion happens in your browser, so private keys never leave your machine.