Everything runs on your machine — your input is processed right here in your browser and never uploaded to any server.
Enter the password the .pfx/.p12 was protected with.
Open the file — it is decoded immediately on your device.
Download certificate.pem (your domain certificate), ca-chain.pem (the intermediates), and private-key.pem.
Point your server at the files: for Nginx, certificate + chain concatenated and the key file.
Moving a certificate from Windows/IIS to Nginx, Apache, a load balancer or almost any non-Microsoft system means turning the .pfx/.p12 back into PEM files. This tool unpacks the archive in your browser: enter the PFX password, open the file, and download the certificate, the CA chain, and the private key as separate PEM files.
Because the archive contains your private key, where you unpack it matters. Here the decryption happens in the page’s memory on your own device — nothing is uploaded — unlike online PFX converters that receive both your archive and the password that protects it.
100% private“The .pfx file, its password, and the private key inside it are processed in this browser tab’s memory only and never leave your device. Do the conversion offline if you like — load the page, disconnect, then open the file.”
PKCS#12 files verify their password with a MAC before anything decrypts; a single wrong character fails cleanly. Watch for keyboard layout differences and trailing spaces. Some very old exports used a blank password — try leaving the field empty.
Some .p7b-style exports and "certificate only" PFX files genuinely contain no key. If the source system exported without the key, no converter can conjure it — re-export from the original machine with "include private key" ticked.
It downloads as an unencrypted PEM so servers can load it directly — treat the file with the same care as a password. Keep permissions tight (chmod 600) and delete copies you no longer need.