How to open .PEM files (certificates and keys) on Android, Windows and Linux

Your web host sends certificate.crt and private.key. A cloud server gives you my-server.pem to log in with. A download page offers an .asc file “to verify the download”. You want to know what each one is, and maybe copy its contents somewhere, but nothing on your phone opens them.

Most of these files are text, and Folders opens them in its text editor on Android, Windows and Linux. One rule before you start: if a file contains a private key, it’s a secret. Read it, but don’t send it to anyone.

What is a .pem file?

PEM is a way of storing cryptographic data as text. The name comes from Privacy-Enhanced Mail, an old email security standard whose text wrapping outlived it. The data is encoded as Base64 and placed between a header and a footer line:

-----BEGIN CERTIFICATE-----
MIIDdzCCAl+gAwIBAgIEAgAAuTANBgkqhkiG9w0BAQUFADBa...
-----END CERTIFICATE-----

The header tells you what’s inside: CERTIFICATE, CERTIFICATE REQUEST, PUBLIC KEY, PRIVATE KEY, RSA PRIVATE KEY, ENCRYPTED PRIVATE KEY or OPENSSH PRIVATE KEY. One file can hold several blocks, such as a certificate followed by the intermediate certificates that vouch for it. The extension is only a hint; the first line is the real answer.

Extension	What it is	Where you meet it
.pem	Any PEM data: certificates, chains, keys	Web servers, API clients; cloud servers’ login key pairs (those are private keys)
.crt	A certificate, usually PEM text, sometimes binary (DER)	SSL/TLS certificates from a host or certificate authority
.csr	A certificate signing request: your public key and details, sent to a certificate authority	Created when you order a certificate
.key	Usually a private key	Next to a .crt on a web server
.pub	A public key, often an SSH key on one line: ssh-ed25519 AAAA… you@laptop	~/.ssh/id_ed25519.pub, the SSH keys page of GitHub or GitLab
.asc	ASCII-armoured OpenPGP data: a public key, or a signature for a download	Software downloads, encrypted email with GnuPG

A word about private keys

If the first line says PRIVATE KEY in any form, anyone who has the file can pretend to be your server or log into your machines. Don’t email it, paste it into a chat, upload it to an online “decoder”, or commit it to Git. Certificates, CSRs, .pub keys and PGP public keys are the opposite: they’re meant to be shared. The private half of an SSH key usually has no extension at all, like id_ed25519 next to id_ed25519.pub.

Folders opens these files on your device, with no account, and doesn’t send them anywhere. Still, a key left in a shared folder such as Downloads is visible to other apps with file access, so don’t keep keys there.

How to open a .pem file with Folders

On Android:

1. Install Folders from the download page and allow access to your files.
2. Find the file, or search for its name.
3. Tap it to open it in the text editor.
4. From an email or chat, tap the attachment and choose Open with → Folders.

On Windows and Linux:

1. Browse to the file in Folders and double-click it.
2. On Windows, the installer adds Folders to File Explorer’s Open with menu for .pem, .csr, .key, .pub and .asc. Windows keeps .crt for its own certificate window, so open .crt files from inside Folders.

What you can do with it in Folders

• See what you’ve got: the header line says certificate, request, public key or private key. ENCRYPTED means the key is protected by a passphrase, which you need to use it but not to look at it.
• Check a certificate chain: the server’s certificate should come first, then each intermediate. Count the BEGIN CERTIFICATE lines with Find.
• Copy the whole block to paste into a hosting panel, including the BEGIN and END lines.
• Edit and Save to build a chain file, by pasting the intermediate certificate under yours. Change nothing inside a block: one wrong character and it stops working.
• Open in hex viewer to check a file that doesn’t look like text. A binary DER certificate starts with the byte 30.

Folders shows the text; it doesn’t decode a certificate into its issuer, expiry date or fingerprint. The tools below do that.

Other ways to open .pem files

• OpenSSL shows everything inside: openssl x509 -in certificate.crt -noout -text for a certificate, openssl req -in request.csr -noout -text for a request.
• Windows opens .crt and .cer files in its own certificate window when you double-click them, with General, Details and Certification Path tabs.
• GnuPG, or Kleopatra from Gpg4win on Windows, handles .asc keys and signatures; OpenKeychain does on Android.
• ssh-keygen -l -f key.pub shows an SSH key’s fingerprint.

Problems opening a .pem file?

• The text is gibberish. The certificate is binary DER, not PEM. Convert it with openssl x509 -inform der -in certificate.crt -out certificate.pem.
• A .key file is gibberish starting with “PK”. It’s a presentation from Apple’s Keynote, which uses the same extension, not a key. Folders doesn’t open Keynote presentations; Keynote can export to PowerPoint or PDF.
• A .pub file is gibberish. It’s probably a Microsoft Publisher document. Publisher opens it, and LibreOffice Draw can import it.
• SSH refuses your key with “UNPROTECTED PRIVATE KEY FILE!”. On Linux, the file’s permissions are too open. Run chmod 600 on the key.

Questions people ask

How do I convert .crt to .pem? If the .crt starts with -----BEGIN CERTIFICATE-----, it’s already PEM: just rename it (Folders can rename files). If it’s binary, convert it with the OpenSSL command above.

Is it safe to open a .pem file? Yes. It’s text and can’t run anything. The risk is sharing it when it contains a private key.

What’s the difference between .pem, .crt and .key? PEM is the text wrapping; .crt and .key say what’s inside, a certificate or a private key. A .crt and a .key are often both PEM files.

How do I verify a download with an .asc file? Import the publisher’s public key into GnuPG, then run gpg --verify file.asc file. “Good signature” means the download is the one they signed.

Related guides: how to open INI, CFG and .env files and how to open shell scripts, plus all 382 file types Folders opens.