PEM ⇄ DER Converter
Convert keys, certificates and CSRs between PEM and DER, both directions. DER is shown/accepted as hex or base64. Runs entirely in your browser — nothing is uploaded.
About this tool
PEM and DER are two encodings of the same cryptographic objects — RSA/EC
private and public keys, X.509 certificates, certificate signing requests
(CSRs), and CRLs. DER is the raw binary ASN.1 form. PEM is just that DER,
base64-encoded and wrapped in -----BEGIN <label>----- / -----END <label>-----
armor. This tool converts between the two in either direction.
How it works
- PEM → DER: paste a PEM block. The tool reads its label (e.g.
CERTIFICATE,PRIVATE KEY,EC PRIVATE KEY,CERTIFICATE REQUEST), decodes the base64 body, and shows the resulting DER bytes as hex or base64, along with the detected label and byte length. - DER → PEM: paste DER bytes as hex or base64, pick a PEM label, and the tool wraps them into a standard 64-column PEM block.
Because it is a generic re-encoder, it does not parse or validate the inner ASN.1 — so it works for any object type, not just a fixed list of key formats.
Privacy
Everything runs locally in your browser via WebAssembly. Your keys and certificates are never uploaded anywhere.
Tips
- DER input accepts
0xprefixes and:/-/ whitespace separators in hex. - For
DER → PEM, you can paste a full-----BEGIN ...-----line as the label and it will be extracted automatically; a blank label defaults toCERTIFICATE.
FAQ
Can I convert a whole certificate chain in one go?
Yes. In PEM → DER mode the tool parses every -----BEGIN ...----- block
in the input, so a full chain (leaf + intermediates + root) comes back as one
DER result per block, each with its detected label and byte length.
How does the "auto" direction decide which way to convert?
It checks for a -----BEGIN header: if one is present the input is treated as
PEM and converted to DER; otherwise the input is decoded as DER bytes (hex or
base64, per the DER format setting) and wrapped into PEM. If your input is
ambiguous, pick pem-to-der or der-to-pem explicitly.
Does converting validate that my key or certificate is well-formed?
No. This is deliberately a generic re-encoder — it decodes the base64/hex and
re-wraps it without parsing the inner ASN.1. That is what lets it handle any
object type (keys, certs, CSRs, CRLs), but it also means a corrupted DER blob
will convert "successfully". Use openssl asn1parse if you need structural
validation.
What label goes into the -----BEGIN line for DER → PEM?
Whatever you type in the label field, uppercased — common ones are
CERTIFICATE, PRIVATE KEY, EC PRIVATE KEY, and CERTIFICATE REQUEST.
Pasting a full -----BEGIN X----- line works too (the armor is stripped), and
leaving it blank falls back to CERTIFICATE. Output is wrapped at the
standard 64 columns.
Developer & Automation Access
Run it from the terminal
Same engine as this page, headless — via the gizza CLI:
gizza tool pem-der-convert "-----BEGIN CERTIFICATE-----..."New to the CLI? Get gizza →
Open it by URL
Pre-fill and auto-run this tool with query parameters — the names match the API/CLI:
https://gizza.ai/tools/pem-der-convert/?input=-----BEGIN%20CERTIFICATE-----...&direction=auto&der_format=hex&label=CERTIFICATEMachine-readable descriptor: tool.json — title + parameters JSON Schema for agents.