What is an SSL format converter?
An SSL format converter changes a certificate, a private key or a signing request between the two encodings it is normally stored in. PEM is the text form: the same bytes, Base64-encoded, wrapped at 64 characters and bracketed by BEGIN and END lines that name what the object is. DER is the binary form: those bytes written plainly, in the strict tag-length-value layout that ASN.1 defines. Converting between them does not change a single byte of the underlying data.
Because it is a re-encoding rather than a transformation, the conversion needs no key and no password, and it cannot alter a signature. The part that is genuinely easy to get wrong is the label. DER carries no label at all — it is just bytes — while PEM is nothing but label plus bytes, and a tool reading a file relies on that label to know what to expect. A certificate's body under a key's label will be rejected, usually with a message about the structure rather than the label.
This converter handles both directions and, importantly, more than one block at a time. A PEM file often holds a whole certificate chain in sequence, which is how servers are usually configured, so the PEM-to-DER direction produces a file per block and zips them when there is more than one. The DER-to-PEM direction reads a binary file, shows its leading bytes as evidence of what it is, and asks you to confirm the label before wrapping it.
How to convert between PEM and DER
- Choose the direction: PEM to DER to get the binary form, or DER to PEM to get the text form.
- For PEM to DER, paste the text including the BEGIN and END lines; several blocks in one paste are all converted.
- Check the labelled list that appears, which names each block and its size as binary and as Base64.
- Download the DER file, or a ZIP when the paste held more than one block.
- For DER to PEM, choose the binary file — it is read in the browser and never uploaded.
- Confirm the label, which becomes the BEGIN and END lines, then copy the PEM text or download it as a .pem file.
SSL Converter limits and rules
| Item | Limit |
|---|---|
| Directions | PEM to DER, and DER to PEM |
| Recognised labels | Certificates, CSRs, CRLs, trusted certificates, public keys and several private-key types |
| Multiple blocks | A PEM paste with several blocks is converted to several DER files, delivered as a ZIP |
| Line wrapping | Generated PEM is wrapped at 64 characters, the conventional width |
| Runs offline | Conversion happens in the page; no file is uploaded or logged |
| Encrypted keys | A passphrase-protected key is converted as bytes, not decrypted |
| Not covered | Changing the key format, decrypting a key, or reading the fields inside the object |
When to use it
- Getting the DER form of a certificate for a device or application that insists on binary.
- Turning a DER certificate into PEM text so it can be pasted into a configuration file.
- Converting a bundle that holds a certificate, an intermediate and a key into separate DER files.
- Recovering armoured text from a binary file whose extension is unclear.
- Checking the leading bytes of an unfamiliar file to see whether it is really DER.
Is it private?
The file is read and converted by JavaScript in this page. Nothing is uploaded, stored or logged — which matters here more than usual, because a private key is often the object being converted. Check the network tab and it stays empty.
Frequently asked questions
Not a byte. PEM is DER encoded as Base64 with label lines around it, so the conversion moves the same bytes between two containers and nothing about the certificate, its signature or its validity is touched. That is why no key or password is asked for and why the operation is safe to repeat. If the output does not work somewhere, the cause is the label or the file the object is placed in, never a change to the data itself.
The extension is a convention, not a guarantee, and the overlap causes most of the confusion: .pem, .crt and .cer often hold PEM text, while .der and sometimes .cer hold binary, and .key is usually a private key in either encoding. The only reliable test is to look at the bytes: PEM always begins with a dash, because it starts with a BEGIN line, while a DER object begins with a tag byte such as 30 for a certificate. That is why the leading bytes are shown after you load a file.
Because DER does not store one. A binary file is just bytes, and there is nothing in it that says "this is a certificate" rather than "this is a request" — the difference is in the internal structure, which a decoder can read but a converter does not need to. The generator guesses from the file name as a convenience, and the guess is worth checking, because the wrong label produces a PEM file that looks fine and is rejected when it is used.
It converts the file, but it does not decrypt it. An encrypted key is still an ASN.1 structure, so its bytes can be re-encoded between PEM and DER like any other, and the BEGIN ENCRYPTED PRIVATE KEY label is preserved. What this tool will not do is ask for the passphrase and produce the unencrypted key — that is a different operation with different risks, and it is better done with the tool that created the key, where the passphrase handling is known.
That is normal and the tool expects it. A PEM file commonly holds a certificate chain — the leaf certificate followed by one or more intermediates — and sometimes a key as well, all in sequence. Each block is detected separately, named in the list and converted on its own. When there is more than one, the DER side is delivered as a ZIP with one file per block, rather than a single blob that would mix unrelated objects together.
The conversion runs in the page — no request is made and the network tab stays empty — but the prudent answer is still to be careful. A private key is the one object here that must not leak, and the habit worth keeping is to convert keys on a machine you control rather than a convenience tool, even a local one. For a certificate or a CSR, which are public by design, pasting is unremarkable; for a key, use whatever tooling your server or your pipeline already has.
Related tools
Written and maintained by Md. Nur Hossain Repon.