Contact

Tools  /  Security  /  PEM Formatter

SECURITY

PEM Formatter

Wrap base64, hex or a raw binary file into proper PEM (RFC 7468 64-column or classic 76-column), or strip an existing PEM block down to raw/JSON-escaped/env-var base64.

More Security tools

Checksum Calculator SHA File Checker HTTP Security Header Reference Password Entropy Calculator Hash Generator Password Generator

What this tool does

Converts between raw key/certificate bytes and properly formatted PEM text in both directions. Format mode takes base64, hex, or an uploaded binary file and wraps it with the right -----BEGIN ... ----- / -----END ... ----- header and correctly wrapped body lines. Strip mode does the reverse — paste an existing PEM block and get its raw base64 body back out, either as one line, a JSON-escaped string, or a ready-to-paste KEY=value environment-variable line.

Why line width matters

RFC 7468, the modern PEM specification, wraps body lines at 64 characters — that's the default here and what every current tool (openssl, Let's Encrypt/ACME clients, browsers) expects. The older 76-character width comes from the original RFC 1421/MIME base64 convention some legacy tooling still produces or expects; both options are offered, plus a custom width for anything in between.

18 standard block types, or your own

Covers the common -----BEGIN ...----- header strings you'll actually run into — certificates, certificate signing requests, CRLs, public/private keys in several formats (PKCS#1, PKCS#8, EC, DSA), PKCS#7 and PKCS#12 bundles, and OpenSSH/ SSH2 keys — or type any custom header for something less common.

Flexible input

Paste base64 (with or without existing PEM headers — they're stripped automatically), paste raw hex bytes, or drag-and-drop / upload a binary file (.der, .cer, .key) directly — a binary file is read byte-for-byte via FileReader, not as text, so it round-trips correctly regardless of what bytes it contains.

JSON-escaped and env-var output

A multi-line PEM block doesn't fit cleanly into a single-line .env file or a JSON config value — Strip mode's JSON-escaped output replaces the real newlines with literal \n sequences (the same escaping JSON.stringify produces) so it can be pasted directly into a .env file, a Kubernetes secret, or a cloud provider's "paste your certificate" text box that only accepts a single line.

Validating the result

"Validate as DER" decodes the current bytes as ASN.1 and reports the outermost structure found (almost always a top-level SEQUENCE for any real key or certificate) — a quick sanity check that what you pasted or uploaded is actually valid DER before you ship it somewhere, without needing the fuller semantic decoding this site's Certificate / DER Structure Viewer does for certificates specifically.

Round-tripping to raw bytes

Both modes can download the decoded bytes directly as a .der file — useful for confirming a format conversion didn't corrupt anything, or for tools that specifically want binary DER rather than PEM text.

Privacy

Everything — decoding, wrapping, validation — happens entirely in your browser. Because this tool can handle private key material, its history is deliberately kept in this tab's memory only and is never written to localStorage, unlike most generators on this site.

FAQ

Frequently asked questions

Why does PEM wrap at 64 characters?
RFC 7468, the current PEM specification, fixes the body line width at 64 characters -- that is what openssl, ACME/Let's Encrypt clients, and browsers all expect today, and is the default here.
What's the difference between the 64 and 76 column options?
64 columns is the modern RFC 7468 standard. 76 columns comes from the older RFC 1421 / MIME base64 convention that some legacy tools still use. If you're not sure, use 64 -- it's correct for essentially everything in current use.
Can I convert a raw .der file to PEM?
Yes -- drag it onto the input box or use the upload button in Format mode. It's read as binary (not text), base64-encoded, and wrapped with whatever header you pick.
What is the JSON-escaped / env-var output for?
Many systems -- .env files, Kubernetes secrets, cloud provider "paste your certificate" fields -- only accept a single line, but a PEM block has real newlines in it. The JSON-escaped output replaces those with literal \n so the whole block fits on one line and can be pasted directly, including as a ready-to-use KEY=value line.
Is it safe to paste a private key into this tool?
Everything runs locally in your browser with no network request at all. Because this tool can handle private key material specifically, its conversion history is kept only in this tab's memory and is never written to localStorage, unlike most generator tools on this site.
What does "Validate as DER" actually check?
It attempts to parse the current bytes as ASN.1/DER and reports the outermost tag found (almost always SEQUENCE for a real key or certificate) and the total byte length -- a quick sanity check that the bytes are structurally valid DER, not a full semantic decode of what the fields mean.
Can I go the other direction -- PEM back to raw base64 or bytes?
Yes, that's Strip mode: paste a PEM block and get the raw base64 body (one line, no headers or wrapping), or download the decoded bytes directly as a .der file.
Is anything I paste or upload sent anywhere?
No. There is no server component to this tool -- decoding, formatting and validation all happen entirely in your browser.
Theme Accent