What is a PEM to DER converter?

PEM and DER are two encodings of the same X.509 certificate: PEM is Base64 text wrapped between BEGIN/END lines, DER is the raw binary bytes underneath. This tool decodes your PEM certificate back into a binary .der file.

How do I use this PEM to DER converter?

Paste or upload your PEM certificate fileClick convertDownload certificate.derThere is no passphrase and no private key involved in this direction.

Is my certificate safe with this tool?

Yes — and you can verify it instead of taking our word for it. The conversion runs entirely in your browser and never touches a private key (there is no key field on this page). To check: open DevTools, select the Network tab, leave the filter on All and run a conversion. You will see a request to /track — a usage counter whose payload is only the processing time (execution_ms). It is sent with sendBeacon, so it appears under ping/Other; filtering by Fetch/XHR shows nothing. No request carries your certificate content.

What is the actual difference between PEM and DER?

Unlike PEM vs CRT, this one is a real byte-level difference. DER is the raw binary ASN.1 encoding of the certificate. PEM is that same binary data Base64-encoded and wrapped between BEGIN/END lines, so it can be pasted as text. DER is slightly smaller and is what Windows, Java keytool and some embedded tooling expect; PEM is what's easy to copy, paste, email and diff.

Yes, this PEM to DER converter is completely free to use at tools.bkns.vn. No registration, subscription, or payment required.

Does this tool support ECDSA certificates?

Yes, fully and identically to RSA. This direction never inspects the key algorithm at all — it only Base64-decodes the PEM envelope — so there is no RSA/ECDSA distinction here, unlike BKNS's PFX-building tools, which are RSA-only today.

PEM to DER Converter

This PEM to DER converter decodes a Base64 PEM certificate into its raw binary DER encoding. PEM is DER wrapped in BEGIN/END headers and Base64 text; DER is the same certificate data as raw bytes, with no headers or text encoding. The conversion happens entirely in your browser and works with both RSA and ECDSA certificates.

Processed entirely in your browser

Your files never leave your browser. The page sends only a usage counter signal containing the processing time — never any file content.

Verify this yourself

You don't have to take our word for it — check it yourself in 3 steps:

Open your browser DevTools and select the Network tab
Leave the filter on All — do not filter by Fetch/XHR
Run the conversion and look at the request list

The usage counter is sent with sendBeacon, so it appears under ping (Other) and NOT under Fetch/XHR — that is why you should not filter. You will see a request to /track carrying the processing time. No request carries your file content or passphrase.

Certificate (PEM/CRT)

or paste the content

The block starting with -----BEGIN CERTIFICATE-----

Equivalent openssl command

If you would rather run it on your own machine, this command produces the equivalent result.

openssl x509 -in certificate.pem -outform der -out certificate.der

How It Works

This tool decodes a PEM certificate into raw binary DER entirely inside your browser — nothing you paste or upload leaves your device. Paste or upload your PEM certificate; the tool reads the CERTIFICATE block, strips the -----BEGIN CERTIFICATE-----/-----END CERTIFICATE----- header lines, and Base64-decodes the body back into its original binary bytes. The result downloads as certificate.der.

This direction never touches a private key — there is no key field on this page — and never loads the node-forge library the PFX tools on this site depend on: PEM and DER are the same certificate data at two different encoding layers, so decoding from one to the other is plain Base64 decoding, not certificate parsing. That also means there is no RSA/ECDSA restriction here: certificates using either algorithm decode identically, since the tool never inspects the key material or certificate fields inside.

Because no forge module loads for this direction, the page is lighter and the conversion is effectively instant.

Common Use Cases

Windows/IIS and Java Tooling: Many Windows certificate stores, IIS imports and Java keytool workflows expect binary DER rather than Base64 PEM text
Embedded/Firmware Deployment: Some embedded devices and firmware certificate stores only accept the compact binary DER encoding
Strict Byte-Size Budgets: DER is slightly smaller than its PEM equivalent (no headers, no Base64 overhead) — useful when a certificate store enforces a byte limit
Round-Tripping: Produce a DER file to test with BKNS's DER to PEM tool, or with openssl x509 -inform der
ECDSA Certificates: Convert modern ECDSA certificates to DER — this direction passes them through unchanged, algorithm-agnostic

🔒Need an SSL certificate?

Protect your website with BKNS SSL — from 199,000đ/year, free installation

Buy SSL

Technical Background

PEM and DER are two different encoding layers of the same underlying X.509 certificate structure — unlike PEM and CRT, which are byte-identical under different file extensions. DER (Distinguished Encoding Rules) is the raw binary ASN.1 encoding of the certificate. PEM takes that same binary data, Base64-encodes it, and wraps it between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines with 64-character line breaks, so it can be safely copied, pasted and emailed as plain text.

Converting PEM to DER is Base64 decoding, not certificate re-encoding: the tool strips the header/footer lines and decodes the Base64 body back into its original bytes. No private key, passphrase, or certificate semantics (subject, SANs, key algorithm) are read or altered — the operation is entirely at the envelope/encoding level, which is also why it works identically for RSA and ECDSA certificates and needs no cryptography library.

One structural difference worth knowing: PEM text can concatenate multiple certificates as separate BEGIN/END blocks in a single file, but a DER file holds exactly one ASN.1-encoded certificate — DER has no bundling concept the way PEM text does.

If you need the equivalent command-line step, openssl x509 -in certificate.pem -outform der -out certificate.der does the same conversion.