What is the PEM file format?
PEM file extension is used by certificate files to store and transport cryptographic keys, certificates and other types of data. PEM files are Base64-encoded and store data in ASCII text format - every block is wrapped in recognizable header and footer lines such as -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.
PEM-encoded certificate files are frequently used on internet servers as they are easy to view using any standard text editor. PEM files are used for authenticating trusted websites and are the default format on Unix-based web servers such as Apache and Nginx. A single .pem file may bundle multiple blocks - for example, a server certificate, intermediate certificates, and a private key - all in one file. PEM is also widely used for SSH key pairs and TLS/HTTPS configuration.
PEM certificate uses a digitally-signed public key for security purposes. The authentication process uses the public key to identify the owner of the key and confirm they are who they claim to be. Private keys stored in .pem files can optionally be protected with a passphrase for additional security.
Originally designed for Privacy-Enhanced Mail in the early 1990s, the PEM encoding was formalized as an IETF standard in RFC 7468 (2015). It remains the most widely used container format for X.509 certificates and cryptographic keys. Related binary formats include .DER and PKCS#12 files; .crt and .key files are often simply renamed .pem files containing a certificate or key respectively.
- PEM files are supported by OpenSSL and most TLS/SSL toolkits.
- Opening a
.pemfile with a text editor clearly shows the marked-----BEGIN-----and-----END-----header and footer sections. - A single
.pemfile may hold different object types:CERTIFICATE,PRIVATE KEY,RSA PRIVATE KEY,PUBLIC KEY,CERTIFICATE REQUEST, and others.
Security & safety
RISK: HIGHThe danger with .pem is the PRIVATE KEY case. A .pem containing '-----BEGIN PRIVATE KEY-----' (or RSA/EC PRIVATE KEY) is a secret: anyone who has it can impersonate your server, decrypt traffic, or log into your cloud instance. NEVER paste a private-key .pem into an online 'PEM viewer/converter' or email it; do conversions locally with OpenSSL. Set strict permissions (SSH refuses a key that's world-readable - 'chmod 600 key.pem'). A .pem that is only a CERTIFICATE (public) is safe to share. Be wary of online certificate converters for anything involving a key. The files themselves are inert text and can't execute.
Format details
in a nutshellPrograms that open PEM files
Windows3 apps
OpenSSL
Open-source Inspect/convert from the command line: 'openssl x509 -in cert.pem -text -noout' to read a certificate; 'openssl pkcs12 -export ...' to make a .pfx. The core tool for PEM.
Windows Certificate Manager (certmgr)
Built-in Double-click a certificate .pem/.cer to view it, or import via certmgr.msc into the certificate store. (For a .pem that is a PRIVATE KEY, Windows can't 'open' it usefully - convert to .pfx first.)
Notepad / any text editor
Open-source Open as text to see the '-----BEGIN ...-----' header and tell whether it's a certificate or a key. Don't paste a private key anywhere untrusted. 
macOS2 apps
Keychain Access
Built-in Double-click/import a certificate .pem to view and trust it. For a private-key .pem, import it into the keychain or convert with OpenSSL as needed.
OpenSSL / LibreSSL
Open-source In Terminal, inspect ('openssl x509 -in cert.pem -noout -text') or convert to other formats. Pre-installed (LibreSSL) on macOS. 
Linux2 apps
OpenSSL
Open-source Pre-installed: read a cert ('openssl x509 -in cert.pem -text -noout'), check a key ('openssl rsa -in key.pem -check'), or convert formats. The standard way to work with .pem.
ssh / web servers (use it)
Open-source SSH key case: 'chmod 600 key.pem' then 'ssh -i key.pem user@host'. Server case: reference the .pem in Apache (SSLCertificateFile) or Nginx (ssl_certificate). Technical details
deep spec| Encoding | Base64-encoded DER data wrapped in ASCII header and footer lines |
| File structure | One or more PEM blocks, each delimited by `-----BEGIN <type>-----` and `-----END <type>-----` lines |
| Underlying binary format | DER (Distinguished Encoding Rules), a binary ASN.1 serialization format |
| MIME type | `application/x-pem-file` |
| Supported object types | `CERTIFICATE`, `PRIVATE KEY`, `RSA PRIVATE KEY`, `PUBLIC KEY`, `CERTIFICATE REQUEST` |
| Line length convention | Base64 data wrapped at 64 characters per line per RFC 7468 |
| Multi-object support | A single `.pem` file may concatenate multiple PEM blocks, such as a full certificate chain plus a private key |
| Common alternate extensions | `.crt`, `.cer`, `.key`, `.ca-bundle` - same PEM format, different naming conventions by role |
| Private key protection | Key blocks can be encrypted with a passphrase using PKCS#8 or legacy PEM encryption headers |
| Primary use cases | TLS/HTTPS server certificates, SSH key pairs, CA certificate bundles, code-signing certificates |
| Interoperability | Convertible to binary `.der` with `openssl x509 -outform DER`; PKCS#12 (`.p12`) files can be exported to PEM |
| Character set | US-ASCII only - Base64 alphabet (A-Z, a-z, 0-9, +, /) plus header/footer dashes and type labels |
| Newline handling | RFC 7468 mandates LF (\n) line endings; many tools also accept CRLF for legacy compatibility |
| Header/footer syntax | Five dashes, `BEGIN` or `END`, a space, the object type label, five dashes - e.g. `-----BEGIN CERTIFICATE-----` |
| Released | PEM email RFCs 1421-1424 (1993); the encoding lives on as the textual format, codified in RFC 7468 (2015) |
| Open standard | Yes · royalty-free |
| Specification | www.rfc-editor.org |
PEM conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about PEM files.
