PEM Format.

A textual encoding for cryptographic objects (keys, certificates, CRLs) defined by RFC 7468 that wraps Base64-encoded DER in BEGIN and END header lines. It belongs to the Cryptography category of cybersecurity.

A textual encoding for cryptographic objects (keys, certificates, CRLs) defined by RFC 7468 that wraps Base64-encoded DER in BEGIN and END header lines.

PEM stands for Privacy-Enhanced Mail, the obsolete email standard from RFC 1421 that introduced the encoding. RFC 7468 formalises the textual format that is now ubiquitous in PKI: a header line such as -----BEGIN CERTIFICATE-----, Base64-encoded DER bytes broken into 64-character lines, and a matching -----END CERTIFICATE----- line. Common label values include CERTIFICATE, PRIVATE KEY, ENCRYPTED PRIVATE KEY, RSA PRIVATE KEY, EC PRIVATE KEY, CERTIFICATE REQUEST and X509 CRL. PEM files are ASCII-safe, can be concatenated to form chains, and are accepted by OpenSSL, BoringSSL, Java keytool, and most TLS libraries. The actual cryptographic structure is still ASN.1/DER inside; PEM is only the armouring layer.

Defences for PEM Format typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Privacy-Enhanced Mail, Base64 DER.