Base64 encode/decode · Guide

Base64 Encoded Certificate: PEM, DER and Converting Between Them

Certificates exist in two forms: DER, which is raw binary, and PEM, which is that binary Base64-encoded and wrapped in header lines. Nearly every certificate problem involving Base64 is really a confusion between the two.

Open tool

PEM is Base64 with a wrapper

A PEM file looks like this — a BEGIN line, Base64 wrapped at 64 characters, an END line:

Text

-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBaMQswCQYDVQQGEwJJ
...
-----END CERTIFICATE-----

Strip the header, footer and newlines and Base64-decode what remains, and you have the DER bytes. That is the entire relationship.

Converting and inspecting

Shell

# DER -> PEM and back
openssl x509 -inform der -in cert.der -out cert.pem
openssl x509 -outform der -in cert.pem -out cert.der

# read a certificate regardless of form
openssl x509 -in cert.pem -noout -text

File extensions lie constantly: .crt and .cer may hold either form. Open the file in a text editor — if you can read -----BEGIN, it is PEM.

Embedding a certificate

Environment variables and JSON fields cannot hold the newlines a PEM file requires, which is why CI systems usually store the whole PEM Base64-encoded a second time as a single line, then decode it at deploy:

Shell

base64 -w 0 cert.pem > cert.pem.b64      # store this value
base64 -d cert.pem.b64 > cert.pem        # restore at deploy time

This double encoding is a frequent source of confusion — if a certificate fails to parse, check whether you are looking at PEM or at Base64-of-PEM.

A note on secrecy

A certificate is public by design; encoding it protects nothing and nothing needs protecting. A private key is the opposite: -----BEGIN PRIVATE KEY----- is also just Base64, and encoding it gives no security whatsoever.

Never paste a private key into an online decoder. Use openssl locally, or a tool that states clearly it runs in your browser.

Frequently asked questions

Is PEM the same as Base64?

PEM is Base64-encoded DER plus BEGIN/END lines and 64-character wrapping.

Can I decode a certificate with a generic Base64 decoder?

Yes, after removing the header, footer and newlines — but the result is binary DER, so use openssl to read it.

Why does my certificate fail to load from an env var?

Newlines were lost. Store it Base64-encoded as a single line and decode at runtime.

Ready to try it?

Open the free browser-based Base64 encode/decode and apply what you just read — no sign-up, runs locally.

Open the Base64 encode/decode tool