Why PEM is a wrapper, not a format

PEM (Privacy-Enhanced Mail, a name that long outlived its original purpose) is nothing more than a Base64 encoding convention with a "-----BEGIN X-----" / "-----END X-----" label wrapped around it — the label tells you what's claimed to be inside, but the actual structure of the bytes depends entirely on what that label says. A "CERTIFICATE" block is X.509 DER underneath; a "PUBLIC KEY" block is a different DER structure (SubjectPublicKeyInfo); a PGP block follows an entirely different binary format from either. This tool deliberately doesn't try to interpret any of that structure — it just decodes the Base64 and reports what it finds, which is exactly why it works uniformly across every PEM label, including uncommon ones this site's more specialized decoders don't have dedicated parsing for.

A hash is a faster, more reliable comparison than reading base64 by eye

Confirming two PEM blocks are actually identical — the same public key sent twice, a certificate that hasn't drifted from a known-good copy — by visually comparing wrapped base64 text is slow and genuinely error-prone; a single flipped character deep in a long block is very easy to miss by eye. Hashing the decoded bytes reduces that comparison to matching two short hex strings, which is both faster and immune to the kind of transcription or wrapping differences (line length, trailing whitespace) that can make visually identical-looking blocks actually differ, or visually different-looking ones actually be the same.