DER to PEM Converter

Choose a .der file and get it as PEM text: copy it or download the .pem file. It works for certificates, private keys, public keys and certificate requests, and it finds out which one your file is. The file stays on your device: nothing is sent to a server.

Choose a .der file or drop it here
Certificate, private key, public key or CSR in binary form (.der, .cer, .crt, .key). Nothing is uploaded: the file is converted inside your browser.

Need the other way round? Use the PEM to DER converter.

What does the converter do to my .der file?

PEM is the DER bytes written as Base64 text, in lines of 64 characters, between a "-----BEGIN ...-----" and an "-----END ...-----" line. The converter reads your file, writes it in that form and does not change a single byte of the data inside.

How does it know if the file is a certificate or a key?

The BEGIN line has to say what the data is, and a DER file does not say it. The tool reads the structure of the file (the shapes of the ASN.1 items inside) to tell a certificate from a private key, a public key, a certificate request or a CRL, and it shows its answer. If it is not sure, or you know better, change the type in the list and the PEM text is made again.

Is my certificate or private key uploaded?

No. The file is read and converted by JavaScript in your browser, and the .pem file is made on your device. Nothing is sent to our server. Even then, keep a private key out of chat apps and public places.

How do I do the same with OpenSSL?

For a certificate: openssl x509 -inform der -in cert.der -out cert.pem. For a private key in PKCS#8 form: openssl pkcs8 -inform der -nocrypt -in key.der -out key.pem. For an RSA key in the old form: openssl rsa -inform der -in key.der -out key.pem. For a public key: openssl pkey -pubin -inform der -in pub.der -out pub.pem.

What are .cer and .crt files?

They are only names. A .cer or .crt file can be DER (binary) or PEM (text). If you open the file in a text editor and see "-----BEGIN CERTIFICATE-----" it is PEM already; if you see unreadable characters it is DER and this converter is the one to use.

The tool says my file is already PEM, or does not look like DER.

A DER file starts with the byte 0x30 (a SEQUENCE). If the file has a "-----BEGIN" line it is already PEM text. If it is Base64 text without the BEGIN and END lines, add them around the text (or use the PEM to DER converter after adding them) - the converter reads the bytes of the file, not Base64.