BYTETOOLS

PEM to DER Converter

Convert PEM to raw DER bytes or re-armour DER as PEM, with a hex dump, byte count and automatic detection of the structure you pasted.

…or drop a .pem or .der fileBinary DER files are detected automatically

What is the PEM to DER Converter?

PEM is DER wrapped in Base64 with BEGIN and END header lines. Converting between them means stripping or adding that armour and Base64-decoding or encoding the bytes — which this tool does in both directions.

  • PEM to DER and DER to PEM in a single tool
  • Automatic structure detection: certificate, SPKI, PKCS#8, PKCS#1, SEC1 or CSR
  • Choice of PEM label when re-armouring raw bytes
  • Hex dump with offsets and an ASCII gutter
  • Downloads for both .der and .pem plus copyable Base64 and hex
  • Fully offline — no upload, no network request

How to use the PEM to DER Converter

  1. 1

    Paste a PEM block, bare Base64 or hex bytes, or drop a .pem or .der file — binary files are detected automatically.

  2. 2

    If you are converting raw bytes to PEM, pick the label to armour them with, such as CERTIFICATE or PRIVATE KEY.

  3. 3

    Click Convert.

  4. 4

    Check the detected structure line to confirm the file is what you expected.

  5. 5

    Download the .der or .pem file, or copy the Base64 or hex form.

About the PEM to DER Converter

Some tools want a .pem file and some insist on raw .der bytes, and the only difference is Base64 armour. This converter strips the BEGIN and END lines and all whitespace to give you downloadable DER, or takes raw bytes and wraps them back into a properly formatted PEM block with 64 characters per line.

It also tells you what you actually pasted. By reading the outermost ASN.1 elements it distinguishes an X.509 certificate from a SubjectPublicKeyInfo, a PKCS#8 PrivateKeyInfo, a PKCS#1 RSA key, a SEC1 EC key or a signing request — useful when a file has the wrong extension or no extension at all.

You get a hex dump of the first block of bytes, the exact byte and character counts, and one-click downloads of both forms. Everything runs in your browser with no uploads, so it works offline and on files you would never send to a web service.

Frequently asked questions

What is the difference between PEM and DER?

DER is the raw binary encoding. PEM is the same bytes Base64-encoded and wrapped in BEGIN and END lines so they survive being pasted into email or a config file. Converting between them changes nothing about the key or certificate itself.

How do I convert a .crt file to .der?

Drop it above and click Convert, then download the .der file. A .crt file is usually PEM despite the extension, which is exactly the confusion this tool resolves — the detected structure line tells you what you really have.

Which PEM label should I use?

It must match the structure: CERTIFICATE for an X.509 certificate, PUBLIC KEY for SPKI, PRIVATE KEY for PKCS#8, CERTIFICATE REQUEST for a CSR. The label is not decorative — tools read it to decide how to parse the body.

Why does my PEM file fail to load even though it looks fine?

Usually invisible damage: Windows line endings, a missing final newline, or spaces introduced by copy-paste. Running it through this converter normalises the encoding and rewraps it at 64 characters, which fixes most of these cases.

Can I convert a private key with this tool?

It will work, since the conversion is pure encoding, but avoid pasting private keys into any web page as a matter of habit. Nothing here is uploaded, but openssl pkey -outform DER does the same job on your own machine.

Related tools