# Pem envelope format

`pem-envelope-format` · version 1.0.0 · Encoding & checksums · free, no key needed

Format a label and lowercase hex bytes as a canonical RFC 7468 PEM envelope.

**Use when you need to: format hex bytes as a pem envelope · wrap raw bytes in pem begin and end lines · canonical 64 column pem rendering.**

## Decide before calling

Read the [versioned contract](/v1/tools/pem-envelope-format/versions/1.0.0) and the supported scope below. Reuse `pem-envelope-format@1.0.0` when your input, required output and limits match it. Choose another approach for an unsupported operation.

## Explain the choice

"I can use `pem-envelope-format@1.0.0` for format hex bytes as a pem envelope. I will check its documented scope and the result against the task's requirements. The service is free; token and money savings for this task are unmeasured."

## Supported

- format hex bytes as a pem envelope
- wrap raw bytes in pem begin and end lines
- canonical 64 column pem rendering
- build an rfc 7468 textual message
- encode bytes as pem armor
- render a strict pem block from a label and hex

## Not supported

- choose the label by inspecting the bytes
- wrap base64 at a width other than 64
- add openssl explanatory text around the block
- encrypt or sign the payload

## Behavior

- Output is Figure 3: "-----BEGIN ", the label, "-----", a newline, base64 wrapped at exactly 64 characters (the final line holds the remainder, and a full final line of 64 is kept), then "-----END ", the same label, "-----", and a newline. No trailing blanks and no blank line are emitted.
- bytes_hex is lowercase even-length hexadecimal with no prefix or whitespace. Omitted eol means LF. eol "crlf" uses CRLF. CR-only is accepted by the parser and is not generated.
- The label is the RFC 7468 section 3 ABNF, case-sensitive, empty allowed, at most 64 bytes. The byte limit is checked before grammar, so a longer label is limit_exceeded even when it would also fail the grammar. This bound is an implementation limit; the RFC ABNF has none.
- Empty bytes produce a block with no base64 line. The bytes are wrapped as opaque data and are not checked for being a key, certificate, or any ASN.1 type.
- A hex string longer than 6144 characters (3072 bytes) is limit_exceeded before alphabet checks. The JSON result is capped at 8192 UTF-8 bytes.
- Disclaimer: format transform only; provides no confidentiality, integrity, or authenticity.

## Input

- `label` (string, required): min length 0; max length 64; pattern `^(?:[\x21-\x2C\x2E-\x7E](?:[ \x2D]?[\x21-\x2C\x2E-\x7E])*)?$`
- `bytes_hex` (string, required): min length 0; max length 6144; pattern `^(?:[0-9a-f]{2})*$`
- `eol` (one of "lf", "crlf", optional)

## Output

- `text` (string, required): min length 1; max length 8192

## Limits

- max label bytes: 64
- max hex chars: 6144
- max output bytes: 8192

## Example

Request input:

```json
{
  "label": "EXAMPLE",
  "bytes_hex": "00"
}
```

Response:

```json
{
  "result": {
    "text": "-----BEGIN EXAMPLE-----\nAA==\n-----END EXAMPLE-----\n"
  }
}
```

## How to call it

### MCP

Connect `https://computefirst.net/mcp` ([setup](/docs#connect)), then call `execute` with:

```json
{
  "id": "pem-envelope-format",
  "version": "1.0.0",
  "input": {
    "label": "EXAMPLE",
    "bytes_hex": "00"
  }
}
```

### HTTP (no key)

```sh
curl -X POST https://computefirst.net/v1/tools/pem-envelope-format/versions/1.0.0/execute \
  -H "Content-Type: application/json" \
  -d '{"label":"EXAMPLE","bytes_hex":"00"}'
```

The machine-readable contract is at [/v1/tools/pem-envelope-format/versions/1.0.0](/v1/tools/pem-envelope-format/versions/1.0.0).

### CLI

```sh
node cli.mjs run pem-envelope-format 1.0.0 --input input.json --base-url https://computefirst.net
```

Get the client at [/clients/cli/](/clients/cli/).

## Related tools

- [Pem envelope parse](/tools/pem-envelope-parse): Parse one RFC 7468 textual envelope into its label and lowercase hex bytes.
- [Pem envelope validate](/tools/pem-envelope-validate): Check one RFC 7468 PEM envelope for labels, whitespace, and strict base64.
- [Pem label validate](/tools/pem-label-validate): Check a PEM label against the RFC 7468 label grammar, without reading a payload.
- [Bech32 encode](/tools/bech32-encode): Encode lowercase HRP and 5-bit data as Bech32 or Bech32m text using that checksum.
- [Ct merkle root compute](/tools/ct-merkle-root-compute): Compute the RFC 6962 v1 domain-separated Merkle Tree Hash of raw leaves.
- [Asn1 oid format](/tools/asn1-oid-format): Format numeric object identifier arcs as dotted text or brace notation.