Turn binary data into text with this DER to PEM converter
Most web servers, JWT libraries and configuration files expect keys and certificates as PEM text. When you receive a binary DER file, for example a .cer downloaded from a Windows CA or a key exported from a Java keystore, this der to pem converter wraps it in Base64 with the correct BEGIN and END lines.
Example
The sample input is a DER public key written as hex:
3059301306072a8648ce3d020106082a8648ce3d030107034200042…Converting it produces:
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEJrocOMVB3s0sRD/b5ehRYgQ/NQNr
PZSYWe+8QUcO6PZIPPOeKruikbZtTIN2h1yQSOOFVuP7AMptTjD+lpKYag==
-----END PUBLIC KEY-----The status line reads "91 bytes → PUBLIC KEY PEM". The Base64 body is wrapped at 64 characters, as the PEM standard requires.
How the PEM type is detected
PEM labels matter: software decides how to parse the block from its BEGIN line. With Detect automatically, the converter examines the top-level ASN.1 structure and chooses one of these labels:
- CERTIFICATE or CERTIFICATE REQUEST: a signed structure of three parts, told apart by the fields inside.
- PUBLIC KEY (SPKI) or RSA PUBLIC KEY (PKCS#1).
- PRIVATE KEY (PKCS#8), RSA PRIVATE KEY (PKCS#1), EC PRIVATE KEY (SEC1) or ENCRYPTED PRIVATE KEY.
- PKCS7: a certificate bundle such as a .p7b file.
If the structure is not recognized, the label falls back to CERTIFICATE. Choose the type from the list when you know better, for example for an X509 CRL.
Input formats
Hex may contain spaces, colons or a 0x prefix. Anything that is not hex is read as Base64, including Base64URL. The bytes are parsed as ASN.1 before conversion, so truncated or corrupted data is reported instead of being silently wrapped.
Common errors and fixes
- "This is already PEM": the input contains a BEGIN line, so no conversion is needed. Use PEM to DER for the reverse direction.
- "runs past the end of the data": the file is incomplete or is not DER. If you upload a PEM text file by mistake, the tool detects the BEGIN line and tells you it is already PEM.
- Wrong label in the output: override it with the PEM type selector.
Once you have PEM, you can read a certificate with the certificate decoder or turn a key into a JWK with PEM to JWK.
Privacy
Files are read and converted in your browser. Nothing is uploaded to a server.