GeezerVison is showing javaevolved.dev — PEM encoding/decoding | java.evolved

Home / Security / PEM encoding/decoding

Security Advanced

PEM encoding/decoding

Encode and decode PEM-formatted cryptographic objects natively.

Code Comparison

✕ Java 8

String pem = "-----BEGIN CERTIFICATE-----\n"
    + Base64.getMimeEncoder()
        .encodeToString(
            cert.getEncoded())
    + "\n-----END CERTIFICATE-----";

✓ Java 25 (Preview)

// Encode to PEM
String pem = PEMEncoder.of()
    .encodeToString(cert);
// Decode from PEM
var cert = PEMDecoder.of()
    .decode(pemString);

Share 𝕏

See a problem with this code? Let us know.

Why the modern way wins

🧹

No manual Base64

PEM headers, line wrapping, and Base64 handled automatically.

🔄

Bidirectional

Encode to PEM and decode from PEM with one API.

🛡️

Standard format

Produces RFC 7468-compliant PEM output.

Old Approach

Manual Base64 + Headers

Modern Approach

PEM API

Since JDK

Difficulty

Advanced

JDK Support

PEM encoding/decoding

Preview

Preview in JDK 25 (JEP 470). Requires --enable-preview.

How it works

The PEM API provides standard encoding/decoding for certificates, keys, and other cryptographic objects in PEM format. No more manual Base64 wrapping with BEGIN/END headers.

Key Derivation Functions

Java 8

SecretKeyFactory factory =
    SecretKeyFactory.getInstance(
        "PBKDF2WithHmacSHA256");
KeySpec spec = new PBEKeySpec(
    password, salt, 10000, 256);
SecretKey key =
    factory.generateSecret(spec);

Java 25

var kdf = KDF.getInstance("HKDF-SHA256");
SecretKey key = kdf.deriveKey(
    "AES",
    KDF.HKDFParameterSpec
        .ofExtract()
        .addIKM(inputKey)
        .addSalt(salt)
        .thenExpand(info, 32)
        .build()
);

Hover to see modern ➜

JDK 25+ →

Security Beginner

Strong random generation

Java 8

// Default algorithm — may not be
// the strongest available
SecureRandom random =
    new SecureRandom();
byte[] bytes = new byte[32];
random.nextBytes(bytes);

Java 9+

// Platform's strongest algorithm
SecureRandom random =
    SecureRandom.getInstanceStrong();
byte[] bytes = new byte[32];
random.nextBytes(bytes);

Hover to see modern ➜

JDK 9+ →

Security Intermediate

TLS 1.3 by default

Java 8

SSLContext ctx =
    SSLContext.getInstance("TLSv1.2");
ctx.init(null, trustManagers, null);
SSLSocketFactory factory =
    ctx.getSocketFactory();
// Must specify protocol version

Java 11+

// TLS 1.3 is the default!
var client = HttpClient.newBuilder()
    .sslContext(SSLContext.getDefault())
    .build();
// Already using TLS 1.3

Hover to see modern ➜

JDK 11+ →