PEM to DER Converter

Choose a .pem file and download it as a .der file. It works for certificates, private keys, public keys and certificate requests. The file stays on your device: nothing is sent to a server.

Choose a .pem file or drop it here

Certificate, private key, public key or CSR. Nothing is uploaded: the file is converted inside your browser.

or paste the PEM text

Need the other way round? Use the DER to PEM converter.

What is the difference between PEM and DER?

Both hold the same data (for example an X.509 certificate or a private key). DER is the raw binary form. PEM is the same bytes written as text with Base64 between a "-----BEGIN ...-----" and an "-----END ...-----" line, so it can be pasted in an email or a config file. Converting PEM to DER only removes that wrapping and decodes the Base64.

Is my certificate or private key uploaded?

No. The file is read and converted by JavaScript in your browser, and the .der file is made on your device. Nothing is sent to our server, so it is safe to use with a private key. Even then, keep a private key out of chat apps and public places.

Why do I get one .der file for each block of my .pem?

A DER file holds exactly one object. A .pem file can hold several (a certificate and the intermediate certificates of its chain, or a key and its certificate). The tool makes a separate .der file for each block and names them file-1.der, file-2.der and so on.

The tool says my private key is encrypted. What do I do?

An old style key with the lines "Proc-Type: 4,ENCRYPTED" and "DEK-Info" is encrypted with a passphrase, and its Base64 is not a valid DER yet. Remove the passphrase first with: openssl rsa -in key.pem -out key-plain.pem (it asks for the passphrase), then convert key-plain.pem here. A key that begins with "BEGIN ENCRYPTED PRIVATE KEY" is a valid DER file as it is, but it still needs its password when it is used.

How do I do the same with OpenSSL?

For a certificate: openssl x509 -in cert.pem -outform der -out cert.der. For a private key in the PKCS#8 form ("BEGIN PRIVATE KEY"): openssl pkcs8 -topk8 -nocrypt -in key.pem -outform der -out key.der. For an RSA key in the old form ("BEGIN RSA PRIVATE KEY"): openssl rsa -in key.pem -traditional -outform der -out key.der (without -traditional OpenSSL 3 writes PKCS#8). This tool keeps the key in the form it has in the .pem file. For a public key: openssl rsa -pubin -in pub.pem -outform der -out pub.der.

Where is a .der file used?

Java and Android read certificates with CertificateFactory (X.509) from DER or PEM. A PKCS#8 private key in DER is what PKCS8EncodedKeySpec expects. Some devices, routers, Windows tools and firmware (secure boot, MQTT or IoT clients) ask for a .der or .cer file in binary form.

Does this tool check that the certificate is valid?

No. It only converts the format. It tells you what kind of object each block is, its size, and a SHA-256 fingerprint of the DER bytes. To read a certificate (owner, dates, SHA-1) use OpenSSL: openssl x509 -in cert.pem -noout -text. To read an APK or keystore certificate use the APK Signature Checker or the Keystore Viewer of this site.