PEM ↔ DER Converter
Convert between PEM (base64-armoured) and DER (raw) for certificates, CSRs, and public / private keys. Multi-block PEM bundles are recognised; the first block is exposed for conversion. Drag-and-drop or pick a .pem / .der / .crt / .cer / .key file.
Input
Result
PEM and DER in one line
DER is the raw binary encoding of an ASN.1 structure (per X.690). PEM is just DER inside -----BEGIN/END LABEL----- base64 armour, defined by RFC 7468. The label tells you what is inside (CERTIFICATE, CERTIFICATE REQUEST, PRIVATE KEY, etc.) — but the content is the same DER bytes either way.
Spec
RFC 7468 (PEM textual encodings) and X.690 (BER/DER).
PEM vs DER, and converting between them
DER is the binary encoding of an ASN.1 structure (a certificate, key or CSR); PEM is that same DER wrapped in base64 and bracketed with -----BEGIN …----- / -----END …----- lines. Tools disagree on which they want — browsers and many APIs prefer PEM text, while some libraries and hardware tools expect raw DER — so converting between them is a routine chore.
This tool converts in both directions in your browser. Worked flow: paste a PEM certificate to get the equivalent DER (shown as hex/bytes), or paste DER to get a PEM block ready to save. It performs a structural conversion only — it will not decrypt an encrypted private key, and it does not change the contents, just the container.
Frequently asked questions
What actually differs between PEM and DER?
Nothing in the content — only the container. PEM is base64-armoured DER with header/footer lines; DER is the raw bytes. Converting is loss-free.
Can it convert an encrypted private key?
No. Encrypted PEM keys must be decrypted first (e.g. with the passphrase in your key tooling); this tool only changes the encoding container.
Is my key or certificate uploaded?
No. Conversion runs entirely in your browser, so even private material stays local.