PEM encoding/decoding

Code Comparison

String pem = "-----BEGIN CERTIFICATE-----\n"
    + Base64.getMimeEncoder()
        .encodeToString(
            cert.getEncoded())
    + "\n-----END CERTIFICATE-----";

// Encode to PEM
String pem = PEMEncoder.of()
    .encodeToString(cert);
// Decode from PEM
var cert = PEMDecoder.of()
    .decode(pemString);

Why the modern way wins

🧹

No manual Base64

PEM headers, line wrapping, and Base64 handled automatically.

🔄

Bidirectional

Encode to PEM and decode from PEM with one API.

🛡️

Standard format

Produces RFC 7468-compliant PEM output.

Old Approach

Manual Base64 + Headers

JDK Support

PEM encoding/decoding

Preview

Preview in JDK 25 (JEP 470). Requires --enable-preview.

How it works

The PEM API provides standard encoding/decoding for certificates, keys, and other cryptographic objects in PEM format. No more manual Base64 wrapping with BEGIN/END headers.