Privacy-Enhanced Mail (PEM) Encoding
PEM is how keys and certificates appear in `.pem` files, environment variables, and Kubernetes secrets. The BEGIN/END lines are the envelope; the Base64 block is the payload.
What It Defines
Textual envelope format for cryptographic objects: `-----BEGIN …-----` / `-----END …-----` delimiters wrapping Base64-encoded DER bytes. Identifies enclosed object type (PUBLIC KEY, CERTIFICATE, PRIVATE KEY, etc.). Widely used for TLS certs, SSH keys, and JWT signing keys in config files.
Canonical (Normative)
Convenient (Practical)
The canonical publication point for finalized RFCs. If a protocol is standardized as an RFC, the RFC Editor text is the normative final reference. Published by the IETF, IRTF, IAB, and independent stream.
Related Specs
JSON cannot carry raw binary; Base64 is how file bytes appear in API responses, data URLs, PEM blocks, and JWT segments. Know the difference between standard Base64 and Base64url.
Every HTTPS connection, SMTP/IMAP over TLS, OAuth token exchange, and API call uses TLS. It is the foundational security layer.
JWTs are the token format for OIDC ID tokens and many OAuth implementations. Understanding the structure and security tradeoffs is essential.