PEM (Privacy-Enhanced Mail)

PEM is the text format used for X.509 certificates, private and public keys, and certificate requests. The name comes from a 1993 e-mail security standard that never caught on; its encoding format did. The modern definition is RFC 7468.

Structure

-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ
...
-----END CERTIFICATE-----

• The body is standard Base64 of binary DER data.
• Lines are wrapped at exactly 64 characters, except the last.
• The label (CERTIFICATE, PRIVATE KEY, PUBLIC KEY, CERTIFICATE REQUEST, RSA PRIVATE KEY, …) tells you what the data is.
• A file may contain several PEM blocks, for example a certificate chain.

Converting PEM and DER

openssl x509 -in cert.pem -outform der -out cert.der
openssl x509 -in cert.der -inform der -out cert.pem

Or paste the PEM block into the Base64 to File decoder: the BEGIN/END lines are removed automatically and you can download the DER file.

Security note

Never paste private keys into online tools you do not trust. Our converters run locally in your browser, but the safest place for a private key is your own machine.