Tools / Certificate Decoder
X.509 Certificate Decoder
Paste one or more PEM-encoded certificates to inspect subject, issuer, validity, SANs, and fingerprints. Parsed entirely in your browser — no upload, no verification of the signature.
The example is a locally generated, self-signed placeholder for example.com — not a certificate issued for any real domain. Paste your own certificate to inspect real data.
Paste a certificate to see its fields.
// About this tool
X.509 Certificate Decoder
This tool parses the ASN.1 DER structure inside a PEM certificate directly in JavaScript — base64-decoding the PEM block, walking the TLV-encoded Certificate structure, and pulling out the fields you'd normally need openssl x509 -text for: subject and issuer distinguished names, validity dates, serial number, signature algorithm, public key algorithm and size, and standard extensions (Subject Alternative Name, Basic Constraints, Key Usage, Extended Key Usage, Subject/Authority Key Identifier).
SHA-256 and SHA-1 fingerprints are computed over the raw certificate bytes using the browser's Web Crypto API — the same fingerprints you'd see in a browser's certificate viewer.
This is a decoder, not a validator: it does not check the signature, does not build or verify a chain of trust, and does not consult any revocation list (CRL/OCSP). Expiry and self-signed status are flagged, but a certificate parsing cleanly is not the same as it being trustworthy.
// When to use it
Check what's actually in a cert file
Paste a .pem or .crt file's contents to see its SANs, expiry, and key algorithm without running openssl.
Debug a hostname mismatch
Compare the SAN list against the hostname you're connecting to — a cert only covers the exact names listed there.
Check a chain's fingerprints against a known-good value
Paste a full chain (multiple PEM blocks) to decode each certificate and compare its SHA-256 fingerprint to a pinned value.
// Questions
Does this verify the certificate is trusted or authentic?
No. It only decodes and displays the fields encoded in the certificate. It does not check the signature, build a trust chain, or check revocation status.
Can I paste a full certificate chain?
Yes — paste multiple -----BEGIN CERTIFICATE----- blocks and each one is decoded separately, with tabs to switch between them.
Is my certificate uploaded anywhere?
No. Parsing and fingerprinting happen entirely in your browser using the Web Crypto API — nothing is sent to a server.
Why does it say 'couldn't parse' for some extensions?
Only the most common extensions have dedicated decoders. Less common ones still show their OID and critical flag, just not a human-readable summary of their contents.
// Related tools