PEM & Certificate Helper
Inspect PEM blocks, convert PEM to and from base64 DER, and compute certificate fingerprints locally.
- Runs locally in your browser
- No upload required
Try it
Supported formats
Privacy
Runs entirely in your browser. Your input is never uploaded, stored, or sent to a third party.
Found 1 PEM block(s): CERTIFICATE (817 bytes).
How it works
- Scanned the text for BEGIN/END label pairs.
- Decoded each base64 body to DER bytes.
- Computed a SHA-256 fingerprint over each DER payload.
- Reported embedded PEM headers and flagged private-key blocks.
- A fingerprint identifies bytes; it does not validate a certificate chain or a signature.
Methodology
- Scan the text for BEGIN/END label pairs and read each base64 body.
- Decode the base64 to DER bytes and report their length.
- Compute a SHA-256 digest of the DER bytes and format it as an uppercase colon-separated fingerprint.
- For conversion, strip the envelope to the base64 body or wrap a validated base64 body at 64-character lines.
Usage
- Paste a PEM block (or a bundle of blocks).
- Choose inspect, pem-to-base64 or base64-to-pem.
- For base64-to-pem, choose the envelope label (CERTIFICATE, PUBLIC KEY, PRIVATE KEY, CERTIFICATE REQUEST).
Examples
These are examples, not current values: they use fixed inputs, while the interactive tool computes live results in your browser.
Inspect a certificate from its base64 DER
{
"mode": "inspect",
"text": "MIIDLTCCAhWgAwIBAgIUR+HYBrx60CWo9AGs0EXeQCJKm2gwDQYJKoZIhvcNAQELBQAwJjEVMBMGA1UEAwwMZXhhbXBsZS50ZXN0MQ0wCwYDVQQKDARUZXN0MB4XDTI2MTAwNTEyMzAwMloXDTM2MTAwMjEyMzAwMlowJjEVMBMGA1UEAwwMZXhhbXBsZS50ZXN0MQ0wCwYDVQQKDARUZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmIkXfjM0ewFCcpdUGDb8JWousj4efaYgf5guAIIMj03+g4E2wHH4C79BGSqqVmQff6fDvW2ADy1W5xkif1jEFl3uXN9vaYj20TnFYIqIRDimRY/oK3jQ3hlez6VrgPnMyRCvjxKfzFnLM/Wycb7DvLyzkysH5QccBEpBU2qPqOsy7h3j6aZGvsOWDgBTwi8tyu6udPu4rqQFfloS7xFVO+/zFEHSd6WI4FwXM+m6+AetV5k61DJhOIFVFVp29r0YG0VR6OrSDEmPl79St2AwQSf51Ild3zbJBVY7Ft7R0mAKHE030/DWoKAeOac2wLvatIcUV2aKELvi4+f/C1J2rQIDAQABo1MwUTAdBgNVHQ4EFgQULZODzve+7708Iim1KnBak7dhUxAwHwYDVR0jBBgwFoAULZODzve+7708Iim1KnBak7dhUxAwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAGcBCL8bXJnPH3Jw34trGH9tJwFZpybS4mVW8/GP7mHZnhER/HaxRdNExUOLP8W94gg/IGrHN9FQMIXKgL31dY0NkHnyv6YFshZG7D0tHRysEMirF6mk1570DFhFMU6oSXPdtcsEJUWRdJRqvKmO0rr9troYLJ3suKIdDiWUrfllMJLiTnPZXrW0wthiWeJMl66Y4BON2qpXTmAX+sADm+qCzv9gHNR/kM/9PlHAN5xi1NKo7kROd3equVhC+YtdDZKcpd2uTz2UEX1uxINAzGJETBjasZGON0epqIhy76r/OH+WIX7/69Mkt+Xm+TxhMgr6UQKMjl5rK3VMvVa2/Ew=="
}Inspect the same bytes with a PUBLIC KEY label
{
"mode": "inspect",
"text": "MIIDLTCCAhWgAwIBAgIUR+HYBrx60CWo9AGs0EXeQCJKm2gwDQYJKoZIhvcNAQELBQAwJjEVMBMGA1UEAwwMZXhhbXBsZS50ZXN0MQ0wCwYDVQQKDARUZXN0MB4XDTI2MTAwNTEyMzAwMloXDTM2MTAwMjEyMzAwMlowJjEVMBMGA1UEAwwMZXhhbXBsZS50ZXN0MQ0wCwYDVQQKDARUZXN0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmIkXfjM0ewFCcpdUGDb8JWousj4efaYgf5guAIIMj03+g4E2wHH4C79BGSqqVmQff6fDvW2ADy1W5xkif1jEFl3uXN9vaYj20TnFYIqIRDimRY/oK3jQ3hlez6VrgPnMyRCvjxKfzFnLM/Wycb7DvLyzkysH5QccBEpBU2qPqOsy7h3j6aZGvsOWDgBTwi8tyu6udPu4rqQFfloS7xFVO+/zFEHSd6WI4FwXM+m6+AetV5k61DJhOIFVFVp29r0YG0VR6OrSDEmPl79St2AwQSf51Ild3zbJBVY7Ft7R0mAKHE030/DWoKAeOac2wLvatIcUV2aKELvi4+f/C1J2rQIDAQABo1MwUTAdBgNVHQ4EFgQULZODzve+7708Iim1KnBak7dhUxAwHwYDVR0jBBgwFoAULZODzve+7708Iim1KnBak7dhUxAwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAGcBCL8bXJnPH3Jw34trGH9tJwFZpybS4mVW8/GP7mHZnhER/HaxRdNExUOLP8W94gg/IGrHN9FQMIXKgL31dY0NkHnyv6YFshZG7D0tHRysEMirF6mk1570DFhFMU6oSXPdtcsEJUWRdJRqvKmO0rr9troYLJ3suKIdDiWUrfllMJLiTnPZXrW0wthiWeJMl66Y4BON2qpXTmAX+sADm+qCzv9gHNR/kM/9PlHAN5xi1NKo7kROd3equVhC+YtdDZKcpd2uTz2UEX1uxINAzGJETBjasZGON0epqIhy76r/OH+WIX7/69Mkt+Xm+TxhMgr6UQKMjl5rK3VMvVa2/Ew==",
"label": "PUBLIC KEY"
}Limitations
PEM is just an envelope
PEM is a textual envelope: a BEGIN label, base64 lines, an END label. The security of a certificate or key lives in the DER payload and in how a verifier builds and checks a trust chain. This tool handles the envelope and the bytes; it deliberately makes no trust claim.
Frequently asked questions
- Does this validate my certificate?
- No. It parses the PEM envelope and computes a fingerprint over the DER bytes. Chain building, expiry checks and signature verification require an X.509 implementation and are not performed here.
- What is a fingerprint useful for?
- Comparing two certificates byte-for-byte. If the SHA-256 fingerprints match, the DER payloads are identical. It says nothing about whether the certificate is trusted.
- Is my key or certificate uploaded?
- No. Everything is parsed and fingerprinted in your browser; the page has no network or storage path.
Sources
Send feedback
Tell us if this tool helped, report a problem, or suggest a tool. Only the message you type is sent — never the input you used in the tool.
Was this tool useful?
Prefer to write to us directly? See the contact page.