PEM / DER Converter
Convert typed PEM blocks and binary DER without uploading keys. Download one DER file or a ZIP of certificate-chain blocks.
Text envelope and binary bytes
PEM is an ASCII envelope with a type label and Base64-encoded DER bytes. DER is binary ASN.1 using definite, minimal lengths. PEM → DER displays each block’s type and bytes while Download returns real binary .der data; multiple blocks are packaged separately in a ZIP.
DER → PEM accepts a binary file or pasted Base64/hex, detects the supported structure and wraps Base64 at 64 characters per line. It does not rename an unknown sequence as a certificate. A pasted PEM label must agree with the detected structure.
Supported containers and validation limits
Supported shapes include SPKI public keys, PKCS#8 private/encrypted-private containers, PKCS#1 RSA keys, SEC1 EC private keys, certificates, certificate requests and X.509 CRLs. Limits are 1 MiB decoded data, 20 blocks, 64 levels and 20000 ASN.1 nodes. Indefinite BER, trailing bytes and non-minimal DER encodings are rejected.
Structure checks do not verify signatures, certificate trust, key ownership or every ASN.1 schema rule. Encrypted containers are preserved as opaque bytes, not decrypted. Traditional OpenSSL Proc-Type/DEK-Info PEM encryption headers are unsupported. Format conversion can output private bytes when you provide a private key.
Reference
Questions & answers
Is the displayed Base64 a DER file?
It is a text representation of DER bytes. Use Download to obtain a binary DER file for software that expects one.
Can I convert a certificate chain?
Yes, up to 20 supported PEM blocks. Their order is retained and each block becomes its own DER file. No chain trust is evaluated.
Is my input uploaded?
No. Processing runs in your browser. Engines load from this site; the tool does not send input to a processing API or save it. Clear removes the visible input and result.