Keys, Certificates & Tokens
PEM to Hex Converter
Decode PEM blocks to hexadecimal bytes. Inspect top-level DER tags, lengths, value previews, and byte offsets below the result.
This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.
The converter removes PEM wrappers and decodes each Base64 body into hexadecimal bytes.
The output has one hex line per block. The field table shows tags, lengths, value previews, and byte offsets.
- Find the algorithm and curve OIDs inside a public key, as the worked example shows.
Sources: RFC 7468: textual encodings of PKIX structures; ITU-T X.690: ASN.1 tag, length, and value encoding
Extract bytes from a public-key block
Input: -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEMKBCTNIcKUSDii11ySs3526iDZ8A iTo7Tu6KPAqv7D7gS2XpJFbZiItSs3m9+9Ue6GnvHw/GW2ZZaVtszggXIw== -----END PUBLIC KEY-----
Settings: No settings. The input is the public P-256 sample key from RFC 7517 Appendix A.1.
Result: 3059301306072a8648ce3d020106082a8648ce3d0301070342000430a0424cd21c2944838a2d75c92b37e76ea20d9f00893a3b4eee8a3c0aafec3ee04b65e92456d9888b52b379bdfbd51ee869ef1f0fc65b6659695b6cce081723
06072a8648ce3d0201 is the id-ecPublicKey OID, and 06082a8648ce3d030107 names P-256. After 03420004 come the 32-byte x and y values of the JWK.
Check PEM labels and block boundaries
- Paste complete PEM blocks with matching BEGIN and END labels.
- Preserve every Base64 body.
- Inspect the hex and any table warnings.
- Labels containing digits or hyphens can be skipped.
- Legacy Proc-Type and DEK-Info headers corrupt this decoder’s output.
- Field boundary checks do not validate certificates, key mathematics, or signatures.