PEM File Decoder
Drop in a .pem, .crt, .cer, .key, .csr, or .pub file to see what is inside. This tool finds every PEM block (the BEGIN/END envelope used by certificates, keys, and signing requests), reads each block's label, and Base64-decodes the body to report its size in raw bytes. It identifies and decodes blocks; it does not fully parse the certificate. The file is read entirely in your browser and never uploaded.
How to decode a PEM file
- Drag a PEM file onto the box, or click to browse for one.
- Read the list of blocks: each shows its label and decoded byte size.
- Use the type summary to confirm the file holds the certificates or keys you expect.
Examples
A certificate plus its private key
server.pem containing a CERTIFICATE block and a PRIVATE KEY block
2 blocks found, types: CERTIFICATE, PRIVATE KEY
Frequently asked questions
Is my PEM file uploaded anywhere?
No. The file is read and decoded entirely in your browser using JavaScript. Nothing is sent to a server, so certificates and keys stay on your device.
Should I paste a private key into this tool?
Avoid pasting or opening private keys in any web tool you do not control. This decoder runs in your browser and uploads nothing, but as a habit you should never expose private key material to web pages. Inspect public certificates and CSRs freely; handle private keys with care.
Does this fully parse the certificate?
No. It identifies each PEM block and Base64-decodes the body to raw bytes, then reports the label and byte length. It does not parse the ASN.1 or DER structure inside, so it will not show the subject, issuer, expiry, or key parameters.
Which PEM block types does it recognize?
Any block wrapped in a BEGIN/END envelope, including CERTIFICATE, CERTIFICATE REQUEST, PRIVATE KEY, RSA PRIVATE KEY, EC PRIVATE KEY, PUBLIC KEY, and DH PARAMETERS. The label is read straight from the BEGIN line, so uncommon labels are detected too.
Can it handle a file with several blocks, like a certificate chain?
Yes. It finds every block in document order, decodes each one, and lists them. A summary shows the count and the unique block types present, which is handy for full-chain bundles.
How does it decode the block body?
It strips all whitespace and line breaks from the Base64 body, then decodes it using a standard RFC 4648 Base64 decoder. The decoded length is the size of the underlying DER bytes. A body that is not valid Base64 is reported as an error.
Related tools
File Type Identifier
Find out what a file really is from its magic bytes, not its extension. Detects images, audio, video, archives, fonts, and more in your browser. Private.
Base64 File Encoder
Encode any file to Base64 and a data URI in your browser. Drop a file to get the raw Base64 and a ready data: URI to copy. Nothing is uploaded.
File Checksum Verifier
Verify a download's checksum in your browser. Drop in a file, get its SHA-1, SHA-256 and SHA-512, and paste the expected hash to confirm a match. Private.
CBOR Decoder
Decode a CBOR file (RFC 8949) to readable JSON in your browser. Handles integers, byte strings, arrays, maps, tags, and floats. Nothing is uploaded.
CSV File Inspector
Inspect a CSV file in your browser: detect the delimiter, encoding and BOM, count rows and columns, guess the header, and preview sample rows. Private.
ELF Header Inspector
Drop a Linux or Unix binary to read its ELF header: 32 or 64-bit, endianness, file type, CPU architecture, OS ABI and entry point. Runs in your browser.