Certificate Converter (PEM ⇄ DER)

Security Client-side certificate ssl tls x509 pem der crt cer converter

This tool runs entirely client-side, in your browser: your data is never sent anywhere.

What it does

Converts an X.509 certificate between its two most common textual/binary encodings:

PEM — Base64 text wrapped with -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- headers. This is what you'll see in .pem, .crt, or .cer files opened in a text editor.
DER — the raw binary encoding of the certificate, typically shown here as a hex dump (and downloadable as a real .der binary file).

Everything happens entirely in your browser — the certificate content is never sent anywhere. This is useful when you need to quickly convert a certificate a CA or tool gave you into the format another system expects (some Java keystores, older Windows tools, or embedded devices expect DER, while almost everything else — Apache, Nginx, most CAs — expects PEM).

Try it

How it works

PEM → DER: the tool strips the -----BEGIN/END CERTIFICATE----- header/footer lines and whitespace, then Base64-decodes the remaining text into raw bytes. Those bytes are the DER encoding — PEM is simply "DER, Base64-encoded, with a header/footer and 64-column wrapping."
DER → PEM: the raw bytes (or hex string) are Base64-encoded, split into 64-character lines, and wrapped with the standard -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- markers.
Certificate details: the tool performs a minimal ASN.1 DER parse (entirely in JavaScript) to extract commonly-needed fields — Subject, Issuer, Validity dates, Serial Number, Signature Algorithm, and Public Key Algorithm — without needing any external crypto library.
File uploads are read with the FileReader API; .der/.cer binary files are read as ArrayBuffer and hex-encoded automatically, while .pem/.crt/.txt files are read as text.

Format cheat sheet

Extension	Typical encoding	Notes
`.pem`	PEM (Base64 text)	Most common, human-readable, used by Apache/Nginx/most CAs
`.crt`	Usually PEM, sometimes DER	Ambiguous — check the file content
`.cer`	Usually DER, sometimes PEM	Common on Windows/Java
`.der`	DER (binary)	Unambiguous — always binary
`.p7b` / `.p7c`	PKCS#7 (not supported here)	Container format, can hold a chain
`.pfx` / `.p12`	PKCS#12 (not supported here)	Contains cert and private key, password-protected

Notes & limitations

This tool converts encoding only — it does not validate the certificate, check its signature, or verify a chain of trust.
PKCS#7 (.p7b) and PKCS#12 (.pfx/.p12) bundles are not supported, since they can contain multiple certificates and/or private keys and need proper container parsing — this tool handles single X.509 certificates only.
The built-in field parser reads standard X.509v3 structures; unusual or malformed certificates may not display every field correctly, but the raw PEM/DER conversion itself will still work since it doesn't depend on parsing the certificate's internal structure.