PEM to DER Converter (and Base64)
Convert PEM, DER and Base64, split bundles and view the ASN.1 tree.
Everything is converted in your browser and private keys never leave it. Still, avoid pasting private keys on shared or untrusted computers.
Use via API
Convert PEM to DER (as Base64 or hex, with an optional ASN.1 structure dump), or wrap Base64/hex DER in PEM armour with a detected or chosen label. Send JSON, get JSON back.
POST https://pithlab.com/api/v1/tools/pem-der-converter
curl https://pithlab.com/api/v1/tools/pem-der-converter \
-H "Authorization: Bearer $PITHLAB_KEY" \
-H "Content-Type: application/json" \
-d '{"input":"-----BEGIN PUBLIC KEY-----\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWIxfVoyp0KgIZ3n+X+yyE91ZT/rm\npCkycrF/J+R5JFfYL0+3tnlR9wE9ZyHH1jQhY6vkSOw0wd/aUHga4HN3/g==\n-----END PUBLIC KEY-----\n","direction":"pem-to-der"}'About the PEM to DER Converter
Convert PEM to binary DER and back, extract the Base64 body, split PEM bundles, detect the block type and inspect the ASN.1 structure. Runs in your browser.
How to use the PEM to DER Converter
- Choose PEM to DER to convert pasted PEM, or DER to PEM to convert an uploaded binary file or a pasted Base64 body.
- For PEM input, every block in a bundle is listed separately with its type, size and Base64 body.
- Download each block as a binary .der file or as its own .pem file, or copy the Base64 body.
- For DER input, keep Auto-detect to pick the PEM label from the structure, or choose a label yourself.
- Open the ASN.1 structure to see every tag, offset, length and object identifier.
Examples
Input
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWIxfVoyp0KgIZ3n+X+yyE91ZT/rm pCkycrF/J+R5JFfYL0+3tnlR9wE9ZyHH1jQhY6vkSOw0wd/aUHga4HN3/g== -----END PUBLIC KEY-----
Output
Offset Length Structure
0 89 SEQUENCE (2 elements)
2 19 SEQUENCE (2 elements)
4 7 OBJECT IDENTIFIER: 1.2.840.10045.2.1 id-ecPublicKey
13 8 OBJECT IDENTIFIER: 1.2.840.10045.3.1.7 prime256v1 (P-256)
23 66 BIT STRING: (520 bits) 04588C5F568CA9D0A8086779FE5FECB213DD594FFAE6A4293272B17F27E47924… (65 bytes)Input
-----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWIxfVoyp0KgIZ3n+X+yyE91ZT/rm pCkycrF/J+R5JFfYL0+3tnlR9wE9ZyHH1jQhY6vkSOw0wd/aUHga4HN3/g== -----END PUBLIC KEY-----
Output
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEWIxfVoyp0KgIZ3n+X+yyE91ZT/rmpCkycrF/J+R5JFfYL0+3tnlR9wE9ZyHH1jQhY6vkSOw0wd/aUHga4HN3/g==
Frequently asked questions
What is the difference between PEM and DER?
DER is the binary encoding of an ASN.1 structure such as a certificate or key. PEM is the same bytes in Base64, wrapped in -----BEGIN and -----END lines so they can be pasted into text files and emails.
Is it safe to paste a private key here?
The conversion runs entirely in your browser and nothing is sent anywhere. Even so, avoid pasting private keys on shared or untrusted computers, where clipboard history, extensions or someone looking over your shoulder could expose them.
How is the PEM label detected?
The tool parses the DER and matches its shape: for example a certificate has a TBS structure with a validity period, a public key is an algorithm plus a bit string, and a PKCS#8 private key starts with a version number and an algorithm. You can always override it.
What is the equivalent OpenSSL command?
For certificates, openssl x509 -in cert.pem -outform der -out cert.der converts PEM to DER, and openssl x509 -inform der -in cert.der -out cert.pem converts back. This tool gives the same bytes for any PEM type.
Why does my DER file show an error?
Strict DER is required: indefinite lengths, truncated files or extra bytes after the structure are reported with the offset where the problem starts.