How to use the certificate converter (pem der base64)
- Paste a PEM block, a base64 string or hex bytes into the input box. Certificates, CSRs and public keys all work.
- Choose the output: PEM, DER as one base64 line, DER as hex or DER as hex with spaces.
- For PEM output you can type a label such as
CERTIFICATEorPUBLIC KEY. Leave it empty to keep the input label or let the tool detect one. - Copy the result. The rows show the DER size and its SHA-256, which you can compare with
openssl x509 -fingerprint -sha256.
PEM, DER, base64 and hex compared
All four are the same bytes written differently. DER is the binary ASN.1 encoding that software actually parses. The other three are text forms of it.
| Format | Looks like | Used for |
|---|---|---|
| DER | Raw binary, starts with byte 30 | Java, Windows, embedded devices, .der and .cer files |
| PEM | BEGIN line, base64 in 64-character lines, END line | Apache, Nginx, OpenSSL, .pem and .crt files |
| Base64 | One string without header lines | JSON, config files, API fields |
| Hex | Two characters per byte, such as 3082 | Debugging, hex editors, test vectors |
Worked example: one certificate in four forms
The default input is a small EC P-256 CA certificate. Its DER form is 422 bytes, which this certificate converter prints as 844 hex characters. Base64 turns every 3 bytes into 4 characters, so 422 bytes become 564 characters, and wrapping at 64 characters gives 9 lines between the BEGIN and END lines.
The SHA-256 of the DER bytes is 65:8C:26:4B:6E:37:06:7B:D1:8E:BF:34:EC:82:2B:26:00:73:08:C8:50:BA:E4:7A:1D:7C:0D:B4:C1:24:C9:C3. It stays the same in every output format because only the encoding changes, and it matches what openssl x509 -noout -fingerprint -sha256 prints for the file.
Common PEM labels
The label between the dashes tells software what the data is. When you convert raw bytes to PEM, the tool keeps the label from the input, uses the one you type, or detects it from the DER structure.
| Label | Contents |
|---|---|
CERTIFICATE | X.509 certificate |
CERTIFICATE REQUEST | PKCS#10 CSR |
PUBLIC KEY | SubjectPublicKeyInfo, any key type |
PRIVATE KEY | PKCS#8 private key |
RSA PRIVATE KEY | PKCS#1 RSA private key |
EC PRIVATE KEY | SEC1 EC private key |
Detection looks at the outer shape of the ASN.1 data, for example a sequence of a sequence, a sequence and a bit string for a certificate. If nothing matches, the label defaults to CERTIFICATE and the row says so.
When to convert and when not to
Convert when a platform insists on a format: a Java keystore import wants DER or PEM, a JSON config wants one base64 line, and a hardware device may want hex. Convert to hex when you need to compare bytes or paste a certificate into test code.
This page only re-encodes. It does not change the contents, decrypt anything or translate between key structures, so a PKCS#1 key stays PKCS#1 even if you type a different label. PKCS#12 (.pfx, .p12) and Java keystore files are different containers and need openssl pkcs12 or keytool.
Mistakes to avoid
- Pasting a generic base64 decoder's input with the BEGIN lines. Dashes and newlines are not base64 characters, which is why PEM needs unwrapping first.
- A wrong label. A certificate under
PUBLIC KEYwill not load. The label must match the content. - Encrypted PEM. Blocks with
Proc-TypeorDEK-Infoheaders are encrypted. Decrypt them with OpenSSL first. - Truncated copies. A missing END line or a cut-off base64 line gives an error instead of partial output.
To read the fields of a converted certificate, use the SSL certificate decoder or the CSR decoder. For plain text encodings see the Base64 encoder.
Worked examples
| Example | Input | Result |
|---|---|---|
| Certificate PEM to hex | Input (PEM, base64 or hex): -----BEGIN CERTIFICATE----- / MIIBojCCAUigAwIBAgICAP8wCgYIKoZIzj0EAwIwNDESMBAGA1UECgwJRWRnZSBM / YWJzMR4wHAYDVQQDDBVlZGdlLXJvb3QuZXhhbXBsZS5uZXQwIBcNMjUwMTAxMDAw / MDAwWhgPMjA1MTA2MTUwODAwMDBaMDQxEjAQBgNVBAoMCUVkZ2UgTGFiczEeMBwG / A1UEAwwVZWRnZS1yb290LmV4YW1wbGUubmV0MFkwEwYHKoZIzj0CAQYIKoZIzj0D / AQcDQgAENYdORnX164l1DzJw6jpNVWwYZ8z2VCPAjAHhSml5sUdTTxrDzOfMQKvM / VF2XHhExBxY8TlHLBV4Fyq0ZQLXHtaNIMEYwEgYDVR0TAQH/BAgwBgEB/wIBADAO / BgNVHQ8BAf8EBAMCAQYwIAYDVR0RBBkwF4IVZWRnZS1yb290LmV4YW1wbGUubmV0 / MAoGCCqGSM49BAMCA0gAMEUCIEqDZUCRpe3Z8/fDjdx3/bwf5fsw7zWdLvRPXvMj / 9cSvAiEAnunad1SaNQFOuvbfcAyJqIvUL1LmNPpbQ3DXCZuc28c= / -----END CERTIFICATE-----; Output format: hex | Input format: PEM; PEM label: CERTIFICATE; DER size: 422 bytes; SHA-256 of DER: 65:8C:26:4B:6E:37:06:7B:D1:8E:BF:34:EC:82:2B:26:00:73:08:C8:50:BA:E4:7A:1D:7C:0D:B4:C1:24:C9:C3 |
| Certificate PEM to one base64 line | Input (PEM, base64 or hex): -----BEGIN CERTIFICATE----- / MIIBojCCAUigAwIBAgICAP8wCgYIKoZIzj0EAwIwNDESMBAGA1UECgwJRWRnZSBM / YWJzMR4wHAYDVQQDDBVlZGdlLXJvb3QuZXhhbXBsZS5uZXQwIBcNMjUwMTAxMDAw / MDAwWhgPMjA1MTA2MTUwODAwMDBaMDQxEjAQBgNVBAoMCUVkZ2UgTGFiczEeMBwG / A1UEAwwVZWRnZS1yb290LmV4YW1wbGUubmV0MFkwEwYHKoZIzj0CAQYIKoZIzj0D / AQcDQgAENYdORnX164l1DzJw6jpNVWwYZ8z2VCPAjAHhSml5sUdTTxrDzOfMQKvM / VF2XHhExBxY8TlHLBV4Fyq0ZQLXHtaNIMEYwEgYDVR0TAQH/BAgwBgEB/wIBADAO / BgNVHQ8BAf8EBAMCAQYwIAYDVR0RBBkwF4IVZWRnZS1yb290LmV4YW1wbGUubmV0 / MAoGCCqGSM49BAMCA0gAMEUCIEqDZUCRpe3Z8/fDjdx3/bwf5fsw7zWdLvRPXvMj / 9cSvAiEAnunad1SaNQFOuvbfcAyJqIvUL1LmNPpbQ3DXCZuc28c= / -----END CERTIFICATE-----; Output format: base64 | Input format: PEM; PEM label: CERTIFICATE; DER size: 422 bytes; SHA-256 of DER: 65:8C:26:4B:6E:37:06:7B:D1:8E:BF:34:EC:82:2B:26:00:73:08:C8:50:BA:E4:7A:1D:7C:0D:B4:C1:24:C9:C3 |
| CSR PEM to spaced hex | Input (PEM, base64 or hex): -----BEGIN CERTIFICATE REQUEST----- / MIH/MIGmAgEAMEQxCzAJBgNVBAYTAkRFMRYwFAYDVQQKDA1CZWlzcGllbCBHbWJI / MR0wGwYDVQQDDBRhcGkuYmVpc3BpZWwuZXhhbXBsZTBZMBMGByqGSM49AgEGCCqG / SM49AwEHA0IABFBVDf7Yau8gUVF4/BAALDZXbvx5SfNi7gnVtmZDYX+xBjMfol5A / ek5zysrXCVzc3YM8f4yQh9IZb/S+MTMP7DugADAKBggqhkjOPQQDAgNIADBFAiEA / hEVDACKDrzfItABemQ1Jdkrd+OJ2OD0BbMGKQUywsqsCIBfrZoF7lyhyIrLl0a0P / kZxp1kPN0C5BJzOIS9vDdSRi / -----END CERTIFICATE REQUEST-----; Output format: hexspaced | Input format: PEM; PEM label: CERTIFICATE REQUEST; DER size: 258 bytes; SHA-256 of DER: 7B:B4:36:BA:EA:CA:11:5E:31:05:28:E9:DA:4E:AB:CD:A0:F4:AA:A2:8A:32:6F:41:68:04:6E:2B:0D:D6:87:94 |
| Public key hex to PEM | Input (PEM, base64 or hex): 30820122300d06092a864886f70d01010105000382010f003082010a02820101008dfc4699f0fb89a94c75898008bfb15ac0254d11630c0717ffd86cca13834fe74be54d9153459cb0c25331555b05e96ed4f0063f6b6525ed67b2cdc4a53ec356f12d776ef0176dc149443965c5d41efce9c183655ea4dc60e4a9d44d4966e5eaf4b6f514425ba0c057bf44cf3d3667a906a2f796fe5160059d98d38e30f30de62f5a110b3800224ba8fe3a15dc16cd8455dab4f3019adc421a8f101f92553284e2be6ecad8bc30adc95968bd649331fe41d76556f7dcf9fa043ad9e696b427a09210759f17e6d9042d0c32a90d793e961aa689805d12ec1c60ce5a86e2ac1cbc2267acc1700fe45be86ca08b95a9af1c7e9182f658de6a765b82633ddd55bd050203010001; Output format: pem | Input format: Hex; PEM label: PUBLIC KEY; DER size: 294 bytes; SHA-256 of DER: A6:91:86:22:47:3C:06:C1:FF:B1:48:8E:DD:94:61:A2:88:BE:77:E0:28:E3:EF:3A:9A:CE:6B:2E:EF:C3:1E:EE |
FAQ
What is the difference between PEM and DER?
DER is the binary encoding of the certificate or key. PEM is that same binary, base64 encoded, split into 64-character lines and wrapped in BEGIN and END lines.
Does converting change the fingerprint?
No. A fingerprint is a hash of the DER bytes, and every output here encodes the same bytes, so the SHA-256 shown never changes.
Can I convert hex to PEM?
Yes. Paste the hex, choose PEM as the output and set a label if the data is not a certificate. Spaces, colons and 0x prefixes in the hex are ignored.
How does the tool decide between hex and base64?
If the input has only the characters 0-9 and a-f (plus separators) and an even length, it is read as hex. Everything else is read as base64, including URL-safe base64 with - and _.
Can it convert private keys?
It can re-encode a private key block between PEM, base64 and hex, but it does not change the key format and it cannot read encrypted keys. Keep private keys off shared machines.
Is the data sent to a server?
No. The conversion and the SHA-256 are computed in your browser.