Skip to content
Page Utils

Certificate Decoder

A certificate decoder reads an SSL/TLS (X.509) certificate and shows what is inside it. Paste a PEM block (or a whole chain), bare Base64 DER, or drop a .pem/.crt/.cer/.der file to see the subject, issuer, validity dates with days left, Subject Alternative Names, serial number, key type and size, signature algorithm, extensions, and SHA-256/SHA-1 fingerprints. It runs in your tab; nothing is uploaded.

Updated

This page has a small ASN.1 DER reader written for the browser. It strips the -----BEGIN CERTIFICATE----- armour, Base64-decodes the body, and walks the X.509 structure: version, serial, issuer and subject distinguished names, the notBefore/notAfter validity window, the public key (RSA modulus size and exponent, EC curve, or Ed25519), and the v3 extensions — Subject Alternative Name, key usage, extended key usage, basic constraints, key identifiers, CRL distribution points, Authority Information Access (OCSP and CA issuer URLs), certificate policies, and embedded CT timestamps. Fingerprints are SHA-256 and SHA-1 digests of the DER bytes, computed with the Web Crypto API, so they match openssl x509 -fingerprint.

It is a decoder, not an SSL checker: it does not connect to a hostname, does not verify the signature or build a trust chain, does not check revocation, and does not tell you whether a browser will trust the certificate. Paste certificates only — a certificate is public, but a private key is not, and this page refuses PRIVATE KEY blocks rather than reading them. CSRs are reported as CSRs, not decoded as certificates.

Decoder

PEM

Paste one or more -----BEGIN CERTIFICATE----- blocks (a chain), or bare Base64 DER. Drop a .pem/.crt/.cer/.der file — it stays in this tab.

Optional .pem, .crt, .cer, or .der file. Read with FileReader in this tab — never uploaded.

Decodes only — it does not check the signature, chain trust, hostname match, or revocation, and it never connects to a server. Never paste a private key here.

How does the Certificate Decoder work?

  1. 1. Paste or drop the certificate

    Paste one or more -----BEGIN CERTIFICATE----- blocks, bare Base64 DER, or drop a .pem, .crt, .cer, or binary .der file. Files are read with FileReader in this tab — never uploaded. Load example fills a fictional self-signed example.com certificate.

  2. 2. Read the decoded fields

    Each certificate gets a card: subject and issuer, valid from and valid to with days left (or how long ago it expired), SANs, serial in hex and decimal, key algorithm and size, signature algorithm, and every extension with its critical flag.

  3. 3. Check the chain order

    Paste a full chain (leaf first, then intermediates) and the page decodes each block in order. If one certificate's issuer does not match the next certificate's subject, you get a note that the blocks may be out of order or from different chains.

  4. 4. Copy as JSON or compare fingerprints

    Copy the decoded fields as JSON for a ticket or runbook, or compare the SHA-256 fingerprint with the one your server, load balancer, or openssl prints. Closing the tab drops everything.

Questions about Certificate Decoder

What is a certificate decoder?
A certificate decoder turns the Base64 text of an SSL/TLS certificate into readable fields: who it was issued to (subject and Subject Alternative Names), who issued it, when it starts and expires, the serial number, the public key type and size, the signature algorithm, and the extensions. This one is an X.509 decoder that runs entirely in your browser, so it also works for internal or staging certificates you would rather not paste into a server-side tool.
What formats can I paste — PEM, DER, or a chain?
PEM (-----BEGIN CERTIFICATE----- … -----END CERTIFICATE-----) is the usual one from .pem, .crt, and most .cer files. You can paste several PEM blocks at once, such as a fullchain.pem, and each certificate is decoded in order. Bare Base64 without the BEGIN/END lines works too, and a binary .der file can be dropped or chosen directly. PKCS#7 (.p7b) and PKCS#12 (.pfx/.p12) bundles are not unpacked; export the certificates as PEM first.
Is my certificate uploaded anywhere?
No. Parsing, date maths, and fingerprinting run with JavaScript and the Web Crypto API in this tab. Nothing is sent to Page Utils, nothing is written to localStorage, and closing the tab clears the paste. Certificates are public by design, but internal hostnames in a SAN list can still be sensitive, so local decoding is the safer habit.
How do I check when an SSL certificate expires?
Paste the certificate and read Valid to: it is the notAfter date in UTC, with the number of days left (or how many days ago it expired) shown in the badge. Valid from is notBefore — a certificate is not valid before that moment either. To check what a live site is serving, export its certificate from the browser's padlock menu or run openssl s_client, then paste the PEM here; this page does not connect to hosts itself.
What are Subject Alternative Names (SANs)?
SANs are the list of DNS names, IP addresses, email addresses, or URIs the certificate is valid for. Modern browsers match the hostname against the SAN list, not the Common Name, so a certificate for example.com that lacks www.example.com in its SANs will fail on the www host. The decoder lists every SAN entry with its type, such as DNS:www.example.com or IP:192.0.2.10.
What is the difference between PEM and DER?
DER is the binary ASN.1 encoding of the certificate. PEM is the same DER bytes Base64-encoded and wrapped in -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines so it can travel as text. They hold identical data, which is why the SHA-256 fingerprint here is the same whichever form you paste.
Can it decode a CSR or a private key?
No. A CSR (-----BEGIN CERTIFICATE REQUEST-----) is a request, not an issued certificate, and is reported as such. If a paste contains a PRIVATE KEY block, the page stops and says so without reading or echoing the key — a private key should never be pasted into a website, and if it was pasted somewhere you do not control, treat it as exposed and rotate it.
Does it verify the signature, the chain, or revocation?
No. It decodes and displays fields only. It does not check that the issuer actually signed the certificate, does not build a path to a trusted root, does not query OCSP or CRLs (it only shows their URLs), and does not test hostname matching. Use openssl verify, your server's TLS test, or a browser for trust decisions. There is one canonical address, /developer/certificate-decoder/, which also covers searches like ssl certificate decoder, x509 certificate decoder, and decode ssl certificate.

What else can I open?

These tools run in your browser. Page Utils does not store, upload, or write to localStorage the keys, tokens, or text you paste. Results are a convenience aid, not legal, tax, or security advice.