2026-10-19 · 8 min read
- pem
- env
- keys
Environment files want a key on one line. PEM wants a line break after the header, after each wrapped body line, and before the footer. The PEM newline tool escapes a multiline block into backslash-n segments, or restores those segments to lines. It also trims, drops blank lines, and strips quotes. Those extra steps are the ones that surprise a checksum.
Run a round trip on a disposable key and diff both directions before you point the same control at a key you care about. Production private keys do not belong in a browser tool.
Escape deletes more than the line breaks
Escape normalizes CRLF and bare CR to LF, trims the whole paste, trims every line, removes lines that are empty after trim, and joins what remains with a literal backslash and n. Indentation is removed. A blank line before the END line is removed. A line of only spaces is removed.
A Windows PEM with an indented body line and a blank line therefore becomes BEGIN, the trimmed body lines, and END. The base64 body survives when it had no interior spaces. The original bytes do not. Parsers that skip empty lines may still import the restored block. A hash of the file will not match the hash you took before the conversion.
- Start from the file, not from a copy that a chat client wrapped.
- Expect blank lines and indentation to vanish.
- Restore and diff before you replace the file.
- Keep a checksum of the original if the bytes matter.
Restore strips one quote from each end
Restore trims, then removes a leading quote character and a trailing quote character independently. They do not have to be the same character. "abc' becomes abc. A normal env value wrapped in matching double quotes becomes the inside, which is the case the strip is for.
The combined escape view already adds PUBLIC_KEY="..." and PRIVATE_KEY="...". Do not wrap that line in a second pair of quotes. A double quote inside the body is copied through, so the env line ends at that interior quote. PEM base64 does not contain a quote. A note you pasted into the same box might.
Undo one escape level, in a fixed order
The four characters backslash, r, backslash, n are replaced with a newline before backslash-n is replaced. A value that was escaped twice, with two backslashes before n, comes back as one backslash and a newline. Half of the doubling remains. If you escaped with this tool once, restore once. A second restore will interpret backslashes that are now part of a line.
The tool never checks BEGIN or END labels, and it never decodes the base64 body. A public key and a private key are just two text areas. The JWT page is the one that imports a PKCS#8 private key for a local RS256 signature. Give it a key you generated for the test, not the block you are about to ship.
Diff the round trip, then stop
Paste the original, escape, restore, and diff the restored text to the original. The diff should be only the blank lines and indentation you are willing to lose. If a quote disappeared or a backslash remained, the env layer is wrong. Fix that before any process reads the variable.
Use the PEM tool for the newline pass, diff for the round trip, the JWT tool for a disposable PKCS#8 signing test, and the Base64 tool when the question is a separate text encoding rather than PEM line breaks. Clear the page when the experiment is over.