PFX/P12 to PEM
Export the private key, certificates and public key from a PFX or P12 file as PEM, including files from OpenSSL 3 (AES) and older RC2 or 3DES ones.
Process locally
Files stay in this browser session. Closing or clearing releases them.
Choose files
Any file, one at a time
Drop files here, or
Adjust settings
Optional: Export, Private key format, Show bag attributes, subject and issuer
Run
Processes in this browser; cancel at any time
About this tool
Convert a PFX or P12 file into PEM text: the private key, the certificate and any chain certificates it holds. You need this when a certificate exported from Windows, IIS or a certificate provider’s portal has to go on nginx, Apache or another server that expects PEM files.
It reads files protected with AES, as OpenSSL 3 writes them, as well as older RC2, RC4 and Triple DES files, including Windows exports. The key can be written as PKCS #8 or in the traditional RSA/EC form. The file and its password stay in your browser and are not uploaded, and the password is never saved with workflows.
How to use it
- Type the file’s password into the text box, then choose or drop the PFX or P12 file. Use example loads a sample file and its password.
- Choose what to “Export”: “Private key and certificates”, “Private key”, “Certificates” or “Public key”.
- Pick the “Private key format”, and turn off “Show bag attributes, subject and issuer” if you want only the PEM blocks.
- Select Run, then preview and download certificate.pem.
Formats and limits
- Input
- Any file, one at a time; Text
- Output
- PEM
- Size limit
- 1 MB
- Settings
- Export (Private key and certificates, Private key, Certificates, Public key); Private key format (PKCS #8, Traditional); Show bag attributes, subject and issuer
- Privacy
- The file and its password stay in this browser session and are not uploaded. The password is an input, so it is never saved with workflows or recipes.
- Price
- Free, no sign-up
Common questions
How do I get separate key and certificate files for nginx?
Run the tool twice, once with “Export” set to “Private key” and once with “Certificates”, and save the two downloads under different names. The certificate that belongs to the key comes first, followed by the other certificates in the order the file stores them.
Why does it say the password is wrong?
Most PFX files carry an integrity check (MAC) computed with the password, so a mistyped password stops the export before anything is decrypted. A line break at the end of the password is ignored, but spaces count.
Is the exported private key protected?
No. The PEM private key is written without a password, so store it as carefully as the PFX file itself.
Which files cannot be read?
Files protected with a public key instead of a password, and files other than PKCS #12 version 3, are not supported. A file that holds no private key can still export its certificates and public key.
What is the difference between the two private key formats?
“PKCS #8 (BEGIN PRIVATE KEY)” works for every key type. “Traditional (BEGIN RSA/EC PRIVATE KEY)” writes RSA keys as PKCS #1 and EC keys as SEC 1 with the curve included, for software that expects those headers; other key types stay PKCS #8.
Related tools
Certificate decoder
Read PEM certificates and certificate requests: subject, issuer, validity, alternative names, public key, key usages, other extensions and fingerprints.
Self-signed certificate
Create a self-signed TLS certificate and private key for development and testing from host names and IP addresses, one per line. The key is generated in the browser.
Key pair generator
Generate RSA, ECDSA (P-256, P-384, P-521), Ed25519 or SM2 key pairs as PEM in PKCS #8 or traditional form, for JWT, TLS or encryption tests.
RSA and SM2 encryption and signatures
Encrypt, decrypt, sign or verify text with an RSA key (PEM: PKCS #1, PKCS #8, public key or certificate) or an SM2 key (hex or PEM). Keys stay in the browser and are never saved with workflows.
Caesar cipher and Morse code
Encrypt or decrypt with the Caesar cipher (any shift), ROT13, ROT47 or Atbash, or encode and decode international Morse code.
Symmetric encryption (AES, SM4, DES)
Encrypt or decrypt text with AES (CBC, ECB, CTR, CFB, OFB or GCM), SM4, DES, Triple DES, Blowfish, RC2, RC5, RC6, RC4, Rabbit or XOR. The key is a separate input and is never saved with workflows.