# PEM / DER / PKCS Decoder

> Identify and inspect certificate and key files in PEM, DER, PKCS#7 and PKCS#12 format.

- Page: https://decoder.tools/pem-der-decoder
- Category: Security, PKI & Crypto
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

A PEM / DER / PKCS decoder identifies which container a certificate or key file uses and lists what it holds: certificates, chains, private keys or CRLs.

## Example

Open a PKCS#7 bundle (`.p7b`) and every certificate in it is listed and decoded:

```text
PKCS#7 / CMS signedData with 2 certificate(s).

# certificate 1
Subject:  CN=example.com
Key:      RSA 2048-bit
…
```

A `.pfx` / `.p12` file is identified as PKCS#12, but its private key and certificates are encrypted with the file's password, so their contents can't be read without it.

## The formats

| Format | Looks like | Holds | Extensions |
|---|---|---|---|
| **DER** | Binary, starts with byte `30` | One certificate, key or CSR | `.der`, `.cer` |
| **PEM** | Text between `-----BEGIN …-----` lines | Base64 DER. A file may contain several blocks | `.pem`, `.crt`, `.key` |
| **PKCS#7** | PEM `BEGIN PKCS7`, or binary | Certificates and chains, no private keys | `.p7b`, `.p7c` |
| **PKCS#12** | Binary, password-protected | Private key plus certificate chain | `.pfx`, `.p12` |

The PEM label tells you what's inside: `CERTIFICATE`, `CERTIFICATE REQUEST`, `PRIVATE KEY` (PKCS#8), `RSA PRIVATE KEY` (PKCS#1), `EC PRIVATE KEY`, `ENCRYPTED PRIVATE KEY` or `PUBLIC KEY`.

## How to use the decoder

1. Paste PEM text, or open a `.der`, `.p7b` or `.pfx` file.
2. PEM input is listed block by block; PKCS#7 bundles have their certificates decoded; PKCS#12 files are identified (their contents are password-encrypted).
3. Each certificate found is shown with its subject, issuer, validity and fingerprint.

You can also inspect and convert these files with `openssl`:

```sh Command line
# DER to PEM, and back
openssl x509 -inform der -in cert.der -out cert.pem
openssl x509 -in cert.pem -outform der -out cert.der

# List the certificates in a PKCS#7 bundle
openssl pkcs7 -in chain.p7b -print_certs -noout

# Inspect a PKCS#12 file (asks for the password)
openssl pkcs12 -in bundle.pfx -info -noout

# Split a PKCS#12 into key and certificates
openssl pkcs12 -in bundle.pfx -nocerts -nodes -out key.pem
openssl pkcs12 -in bundle.pfx -nokeys -out certs.pem
```

## At a glance

| | |
|---|---|
| PEM | RFC 7468 (textual encodings) |
| PKCS#7 / CMS | RFC 2315 / RFC 5652 |
| PKCS#12 | RFC 7292 |
| Private keys in | PEM `PRIVATE KEY` blocks and PKCS#12 only |

## FAQ

### Which format does my web server want?

Nginx and Apache want PEM: the certificate followed by intermediates in one file, and the key in another. IIS and Windows import PKCS#12 (`.pfx`). Java keystores can import PKCS#12 directly.

### Why does my PEM file contain several certificates?

It's a chain: your certificate first, then one or more intermediates. Servers send the whole chain so clients can link your certificate to a trusted root.

### What's the difference between "BEGIN PRIVATE KEY" and "BEGIN RSA PRIVATE KEY"?

`PRIVATE KEY` is PKCS#8, a generic wrapper for any key type. `RSA PRIVATE KEY` is the older RSA-only PKCS#1 format. `openssl pkey` converts between them.