Overview
Decodes X.509 certificates in PEM or DER form and shows the subject, issuer, validity window, Subject Alternative Names, public key type and size, signature algorithm, extensions and SHA-256 and SHA-1 fingerprints. Paste a whole chain to step through each certificate. Parsing happens locally in your browser with a small ASN.1 reader.
How It Works
Paste one or more -----BEGIN CERTIFICATE----- blocks, or upload a .pem, .crt, .cer or .der file. The decoder reports whether the certificate is valid, expired or not yet valid with the number of days left, and flags self-signed and CA certificates. Every extension is listed with its critical flag. Copy the summary, or download it as a text report or as JSON for scripts and tickets.
Step-by-Step Usage Guide
- Paste the PEM text or upload the certificate file.
- Check the validity badge and the days remaining before expiry.
- Confirm the SANs cover every hostname the certificate must serve.
- Review key size, signature algorithm and Extended Key Usage.
- Copy the report or download it as text or JSON.
Technical Specifications & Standards
A certificate is a DER-encoded ASN.1 structure: the to-be-signed part, a signature algorithm and the signature. The decoder walks the tag-length-value tree, decodes object identifiers and maps the common ones to names, such as sha256WithRSAEncryption, ecdsa-with-SHA256 and Ed25519. Distinguished names are shown in RFC 4514 style, for example CN=example.test, O=Example. For RSA keys it reports the modulus size and public exponent; for EC keys it names the curve, such as P-256 or P-384. Decoded extensions include Subject Alternative Name with DNS, IP, email and URI entries, Basic Constraints, Key Usage, Extended Key Usage like serverAuth and clientAuth, key identifiers, CRL distribution points, Authority Information Access URLs for OCSP and CA issuers, and certificate policy OIDs. Fingerprints are computed with WebCrypto over the exact DER bytes, so they match openssl x509 -fingerprint. Pasting a private key or a CSR returns an explanation instead of decoding, and the key text is not echoed back.
Targeted Use Cases
- Checking when a TLS certificate expires before scheduling a renewal.
- Confirming a new certificate includes every hostname as a Subject Alternative Name.
- Comparing SHA-256 fingerprints when pinning a certificate in a mobile app.
- Inspecting each link of a chain returned by openssl s_client -showcerts.
- Verifying a self-signed development certificate has the right IP SAN for localhost.
Notes & Gotchas
- Rely on SANs rather than the Common Name, since browsers ignore CN for hostname matching.
- Renew well before expiry; a badge turns amber when fewer than 30 days remain.
- Avoid certificates signed with SHA-1 or MD5, which browsers reject for TLS.
- Never paste private keys into web tools; the decoder only needs the public certificate.
Frequently Asked Questions
How do I get a website's certificate to decode?
Run openssl s_client -connect example.com:443 -showcerts and paste the output; every certificate block in it is found. You can also export the certificate from the browser's padlock menu as a PEM or DER file and upload it.
What is the difference between PEM and DER?
DER is the binary encoding of the certificate. PEM is the same bytes in base64 between BEGIN and END CERTIFICATE lines. The decoder reads both, and an uploaded DER file is converted to PEM in the text box.
Do the fingerprints match OpenSSL?
Yes. The SHA-256 and SHA-1 fingerprints are hashes of the raw DER bytes, the same input openssl x509 -fingerprint uses, shown as colon-separated upper-case hex.
Does this check whether the certificate is trusted or revoked?
No. It decodes and reports what the certificate contains, including dates and OCSP URLs, but it does not verify signatures against a trust store or contact revocation servers.
Why does it refuse my file?
It accepts only certificates. Private keys, certificate signing requests and bare public keys get a message saying what they are, so you can paste the issued certificate instead.
Related tools
- RSA Key Pair Generator - Create 2048-4096 bit RSA key pairs as PEM with the Web Crypto API - generated and kept entirely on your device.
- HTTP Security Headers Analyzer - Paste raw response headers to grade CSP, HSTS, X-Content-Type-Options, framing, Referrer-Policy, Permissions-Policy, COOP/COEP/CORP and cookie flags, with a concrete fix for each. Nothing is fetched.
- Hash Type Identifier - Identify which algorithm produced a hash - MD5, SHA-1, SHA-256, SHA-512, bcrypt, Argon2, crypt formats, NTLM, CRC32 and more - from its length, alphabet and prefix.
- JWT Decoder - Decode JWT headers and payloads locally — claims pretty-printed, expiry checked. Signature verification stays on your backend.
- Base64 Encoder/Decoder - Encode text to Base64 or decode Base64 strings — full UTF-8 support, entirely in your browser.
- URL Encoder/Decoder - Encode special characters for safe URL usage, or decode percent-encoded strings.