PFX / P12 to PEM Converter

Drop in a password-protected .pfx or .p12 file to split it into a certificate, private key, and CA chain as separate .pem files. Works with both modern and legacy PKCS#12 encryption.

Drop a .pfx or .p12 file here, or click to choose
PKCS#12 files (.pfx, .p12)

How this works: this page loads a JavaScript cryptography library (node-forge, self-hosted on this page — no CDN) and decrypts your file directly in this browser tab. The file, your password, and the private key it contains are never sent to any server; nothing is uploaded.

Compatibility: handles both the modern default OpenSSL 3.x PKCS#12 encryption (AES) and the older legacy encryption (RC2/3DES) used by many existing Windows- and IIS-exported certificates.

Troubleshooting

"Wrong password" or a MAC-verification error

Double-check the password. A PKCS#12 (.pfx/.p12) file can be protected with either modern AES encryption or older RC2/3DES encryption, and either way a wrong password fails the same MAC-verification check rather than giving a more specific error.

The CA chain file comes out empty

Not every .pfx bundle includes intermediate or root CA certificates — some are exported as just a leaf certificate and its private key. An empty CA chain file usually means the original export didn't include one, not that something went wrong here.

Prefer the command line?

openssl pkcs12 -in file.pfx -clcerts -nokeys -out cert.pem openssl pkcs12 -in file.pfx -nocerts -nodes -out key.pem openssl pkcs12 -in file.pfx -cacerts -nokeys -chain -out ca.pem

This is exactly what this page does under the hood — it's tested against real OpenSSL output to make sure the split files match.