Security tools

PEM ↔ Hex

Convert a PEM block to the raw hex of its DER payload, or wrap hex bytes back into PEM armor. On your device.

Runs on your device. The file is never uploaded.

PEM to hex prints the DER payload of every PEM block in a file as lowercase hex, each under its own label and split by a blank line. Switch mode to hex-to-pem and bytes are wrapped back into armor under label, which starts at CERTIFICATE. Structure is never checked, so any even count of hex digits is wrapped without complaint.

Input

Options

Questions

What does pem-to-hex give me?

The raw DER payload of each PEM block as lowercase hex, with the block label above it. Every block in the file is converted, not only the first, so a chain file gives you one labelled hex section per certificate, separated by a blank line.

How do I go the other way?

Switch mode to hex-to-pem and set label to the PEM name you want, which defaults to CERTIFICATE. Common alternatives are PUBLIC KEY and PRIVATE KEY. The hex is decoded to bytes and wrapped in the matching BEGIN and END armor.

Why did I get an error about hex digits?

Because the input was not clean hex. The tool strips whitespace and then requires hex characters only, in an even count, refusing with "expected a hex string with an even number of digits" otherwise. An odd digit count means at least one byte is incomplete, so it stops rather than guessing.

Does it check that my hex is valid DER?

No. hex-to-pem base64 wraps whatever bytes you give it, valid structure or not, and the only check it makes is that the input is hex with an even digit count. To find out whether the result parses as a certificate, run it through x509-parse afterwards and see what it says.

Why would I want the hex at all?

To look at the DER bytes directly, to paste them into a decoder or a debugger, or to hand raw bytes to something that will not take base64. It is a format change only; no field is interpreted and nothing is validated.

Related Security tools

n→nX.509 certificate parserDecode a PEM or DER X.509 certificate into subject/issuer/validity/public key/extensions. Reports what the certificate says about itself. No chain building, no revocation check, no clock: it does not tell you whether to trust it.Runs on each file you dropn→nCSR parserDecode a PEM or DER PKCS#10 certificate signing request into subject, public key and requested extensions (including subjectAltName, when present in an extensionRequest attribute). Reports the request, not a decision about whether it should be signed.Runs on each file you dropn→nCRL parserDecode a PEM or DER Certificate Revocation List into issuer, update times, and each revoked serial with its revocation date/reason. Reports what the CRL states, not whether it is current, or whether a given certificate is on it if you have not checked.Runs on each file you dropn→nJWK ↔ PEMConvert an RSA or EC key between JWK (JSON) and PEM (SPKI/PKCS8), via crypto.subtle import/export. Ed25519/OKP keys are not supported. On your device.Runs on each file you dropn→nPublic key from cert / private keyExtract the public key from an X.509 certificate (always available; it is right there in the cert), or from an RSA/EC private key. RSA is always derivable (n/e are part of the private key itself); EC only when the key embeds its public point (SEC1's optional field; usually present, not guaranteed). This tool does not do elliptic-curve scalar multiplication to compute a missing one.Runs on each file you drop