FormatterHQ
JSON Tools XML Tools YAML Tools CSV & TSV Tools HTML Tools CSS Tools JavaScript Tools SQL Tools Code Formatters & Beautifiers Minifiers Validators Data Converters Data to Class Generators Escape & Unescape Encode & Decode Base64 Tools Hash & Cryptography String & Text Utilities Number Converters Color Converters Unit Converters IP & Network Tools Random Data Generators Diff & Compare Viewers & Editors Image Tools PDF Tools Markdown Tools SEO & Webmaster Tools Developer Utilities JSON Formatter PDF Tools XML Formatter Beautifiers Converters Blog

PEM to DER Converter

Paste a PEM certificate, public key, private key or CSR to get the binary DER bytes as hex, one-line Base64 or a hex dump, with a .der file to download.

Input TEXT
Output TEXT
Ready.

How to use the PEM to DER Converter

  1. Paste a PEM block, including the -----BEGIN …----- and -----END …----- lines.
  2. Choose Show DER as: Hex, Base64 (single line) or Hex dump.
  3. For hex output, pick a Hex separator: none, space or colon.
  4. Click Convert to DER, then copy the output or download the .der file.

Convert PEM to DER in one step

PEM and DER hold exactly the same data. DER is the raw binary encoding, and PEM is that binary wrapped in Base64 with BEGIN and END lines so it survives email and copy-and-paste. This pem to der converter strips the wrapper and gives you the binary bytes, which some Java keystores, Windows tools, embedded devices and APIs require.

Example

Converting the sample EC public key with the Hex dump view gives 91 bytes:

00000000  30 59 30 13 06 07 2a 86 48 ce 3d 02 01 06 08 2a  |0Y0...*.H.=....*|
00000010  86 48 ce 3d 03 01 07 03 42 00 04 26 ba 1c 38 c5  |.H.=....B..&..8.|
00000020  41 de cd 2c 44 3f db e5 e8 51 62 04 3f 35 03 6b  |A..,D?...Qb.?5.k|
…

The status line reads "PUBLIC KEY: 91 bytes of DER". The leading 30 is the ASN.1 SEQUENCE tag, which almost every certificate and key starts with.

Output options

  • Hex: one continuous string, or bytes separated by spaces or colons. Colon-separated hex matches the style of OpenSSL fingerprints.
  • Base64 (single line): the PEM body without line breaks or headers. This is the form expected by x5c entries in a JWK and by many JSON APIs.
  • Hex dump: offsets, 16 bytes per row and an ASCII column, like xxd or hexdump -C.

The download uses a name based on the PEM type: certificate.der, request.der, public.der, or key.der for private keys.

Good to know

  • Only the first PEM block is converted. When you paste a chain, the status line says "first of N blocks". Convert the others one at a time.
  • A DER file cannot hold several certificates the way a PEM file can. For a chain in one binary file, use PKCS#7 (.p7b).
  • Converting does not decrypt anything. An ENCRYPTED PRIVATE KEY stays encrypted in DER form.
  • The command-line equivalent is openssl x509 -in cert.pem -outform der -out cert.der for certificates, or openssl pkey -outform der for keys.

To go the other way, use the DER to PEM converter. To see what the bytes mean, paste the same PEM into the ASN.1 decoder. For plain Base64 work unrelated to keys, try Base64 decode.

Privacy

The conversion runs in your browser. Keys and certificates are never uploaded, and the .der download is created locally.

Frequently asked questions

What is the difference between PEM and DER?
DER is the binary ASN.1 encoding of a certificate or key. PEM is the same bytes encoded as Base64 and placed between BEGIN and END lines. Converting between them loses no information.
Is a .cer file PEM or DER?
It can be either, because the extension is only a convention. If the file opens as readable text starting with -----BEGIN, it is PEM. If it looks like binary data, it is already DER.
Why does the converter ignore my second certificate?
A DER file holds a single ASN.1 structure, so only the first PEM block is converted. Paste each certificate separately, or package the chain as PKCS#7 with openssl crl2pkcs7.
Can I convert a private key to DER?
Yes. PKCS#8, PKCS#1 and SEC1 private keys all convert, and the download is named key.der. Treat the DER file as carefully as the PEM file, since it holds the same secret.

Last updated October 3, 2026

Related tools

DER to PEM Converter Convert binary DER (.der, .cer) certificates and keys, or their hex/Base64 dump, into PEM text with the right BEGIN/END header. JWK to PEM Converter Convert JSON Web Keys or a whole JWKS (RSA, EC, OKP) into PEM public (SPKI) and private (PKCS#8) keys. PEM to JWK Converter Convert PEM public keys, private keys and certificates (RSA, EC, Ed25519) to JSON Web Keys or a JWKS with a thumbprint kid. ASCII to Text Convert ASCII or Unicode character codes (decimal, hex, octal or binary) back into readable text. Binary to Text Translate binary code (groups of 8 bits) back into readable text, with UTF-8 support. Byte to String Convert a list or array of byte values (decimal, hex or signed) back into a readable UTF-8 string. ROT13 Encoder / Decoder Encode or decode ROT13 text instantly. ROT13 shifts each letter 13 places, so the same operation hides and reveals spoilers. SAML Response Decoder Decode Base64 or deflated SAMLResponse and SAMLRequest messages into readable XML and summarise issuer, NameID, conditions and attributes. String to Byte Array Convert a string into its UTF-8 byte values as a decimal list, array or signed Java byte array. String to Hex Convert text to hexadecimal: each UTF-8 byte of the string is written as two hex digits. Text to ASCII Codes Convert each character of your text to its ASCII / Unicode code in decimal, hex, octal, binary or HTML form. Text to Binary Convert text to binary code: every UTF-8 byte becomes a group of eight 0s and 1s.