Privacy-Enhanced Mail · X.509 · crypto wrapping
Wrap base64 content in PEM header/footer lines, or strip them to extract the raw base64. Used for X.509 certificates, private keys, CSRs, and all standard crypto/TLS tooling.
Label field or click a preset like CERTIFICATE, RSA PRIVATE KEY, or PUBLIC KEY.Raw base64 → PEM box — the wrapped block appears instantly in PEM output.Copy PEM to grab the full -----BEGIN …----- block to your clipboard.PEM → raw base64 and the extracted base64 appears below it..pem, .crt, .cer, or .key file directly — click Load File or drag & drop it onto the PEM → raw base64 box.Clear any time to reset a box and start over.Turn raw base64 into proper -----BEGIN CERTIFICATE----- blocks that OpenSSL, web servers, and load balancers expect.
Strip the header/footer lines to recover the pure base64 body for decoding, diffing, or hashing.
PEM requires base64 wrapped at 64 characters per line. The tool does this for you, so pasted output stays spec-compliant.
Presets for CERTIFICATE, RSA PRIVATE KEY, EC PRIVATE KEY, CERTIFICATE REQUEST, and PUBLIC KEY cover the common formats.
Convert pasted key material into the exact text format needed by cloud consoles and TLS config files.
Everything runs in your browser. Nothing is uploaded, logged, or sent to a server — safe for private keys.
PEM (Privacy-Enhanced Mail) is a text format that wraps base64 data between a -----BEGIN …----- line and a matching -----END …----- line. It's the de-facto standard for X.509 certificates, private keys, and CSRs.
Neither. It only adds or removes PEM header/footer lines and re-wraps existing base64 into 64-character lines. Paste base64 that is already encoded; it does not convert raw bytes to base64.
PEM descends from MIME Base64, which wraps output at 64 characters per line for safe email transport. The tool enforces this wrapping automatically.
No — you can type any label into the field. But tools like OpenSSL expect standard labels such as CERTIFICATE, PRIVATE KEY, PUBLIC KEY, or CERTIFICATE REQUEST.
The unwrap side needs a complete block with matching -----BEGIN …----- and -----END …----- lines. Paste the full PEM block, including both lines and the base64 in between.
No. PEM is just a textual envelope around base64. It provides no secrecy or integrity protection — the contents remain fully readable to anyone who unwraps them.
Yes. Click Load File or drop a .pem, .crt, .cer, or .key file onto the unwrap box. Its contents are read locally and unwrapped to raw base64. The file never leaves your browser.
Never. All wrapping and unwrapping happens locally in JavaScript. Your keys and certificates are not sent to, stored on, or logged by any server.