Skip to content
Page Utils

CSR Decoder

A CSR decoder reads a PKCS#10 certificate signing request and shows its subject, requested SANs, public key, signature algorithm, attributes, and SHA-256 fingerprint. Paste PEM or drop a .csr, .pem, or .der file; decoding stays in your browser. It does not submit, generate, sign, or approve a request.

Updated

A certificate signing request (CSR) is a signed PKCS#10 structure containing a subject, public key, and attributes such as requested X.509 extensions. This page removes PEM armour or reads DER, walks the ASN.1 structure in your browser, and shows the subject DN, requested Subject Alternative Names, public-key type and size or curve, signature algorithm, safe attribute metadata, requested extensions, and a SHA-256 fingerprint of the CSR DER.

Decoding describes what the request contains; it does not prove control of a domain, verify identity, submit anything to a certificate authority, issue a certificate, generate keys, or promise that a CA will copy requested extensions into a certificate. Nothing is uploaded or stored. A challengePassword is reported only as present because its value may be sensitive. If you have an issued X.509 certificate instead, use Certificate Decoder.

Decoder

PEM

Paste a -----BEGIN CERTIFICATE REQUEST----- (or NEW CERTIFICATE REQUEST) block, or drop a .csr/.pem/.der file — it stays in this tab.

Optional .csr, .pem, or .der file. Read with FileReader in this tab — never uploaded.

Decodes only — it does not verify the CSR signature, submit a request to a CA, generate keys, or approve SANs. A challengePassword is reported only as present. Never paste a private key here. Issued certificates belong on Certificate Decoder.

How does the CSR Decoder work?

  1. 1. Paste or drop the CSR

    Paste a -----BEGIN CERTIFICATE REQUEST----- or -----BEGIN NEW CERTIFICATE REQUEST----- block, or drop a .csr, .pem, or binary .der file. FileReader reads it in this tab; nothing is uploaded. Load example uses a fictional public request.

  2. 2. Read the requested identity

    Review the subject DN and SANs requested through the extensionRequest attribute. A requested name is not proof of ownership and a CA may reject or change it.

  3. 3. Inspect key and signature metadata

    Check the public-key algorithm, RSA size or EC curve, and the CSR signature algorithm. These fields describe the request; the page does not issue a certificate or make a trust decision.

  4. 4. Compare or copy the result

    Compare the SHA-256 DER fingerprint or copy the safe decoded JSON. challengePassword values are always hidden. Clear the form or close the tab to drop the input.

Questions about CSR Decoder

What is a CSR decoder?
A CSR decoder turns a PEM or DER PKCS#10 certificate signing request into readable fields. It shows the requested subject and SANs, public key, signature algorithm, attributes, requested extensions, and a SHA-256 fingerprint. It does not issue a certificate or send the request to a CA.
What is the difference between a CSR and a certificate?
A CSR asks a certificate authority to issue a certificate and contains a public key plus requested identity fields. An X.509 certificate is the issued document, with an issuer, serial number, validity dates, and the CA's signature. If your PEM says CERTIFICATE rather than CERTIFICATE REQUEST, use Certificate Decoder.
What CSR formats can I use?
Paste PEM labelled CERTIFICATE REQUEST or NEW CERTIFICATE REQUEST, or choose a .csr, .pem, or binary .der file. PEM is Base64-wrapped DER, so the decoded PKCS#10 data is the same. PKCS#7 and PKCS#12 bundles are not accepted.
Does the decoder upload or submit my CSR?
No. PEM decoding, ASN.1 parsing, and SHA-256 fingerprinting run in this browser tab. The page does not upload the CSR, contact a certificate authority, fetch a domain, or write the request to localStorage. Closing the tab clears the in-memory input.
Are the SANs in a CSR guaranteed to appear in the certificate?
No. SANs in extensionRequest are requests, not approved names. A certificate authority applies its own validation and policy and may reject, remove, or change requested extensions. Decoding a SAN does not prove control of that DNS name, IP address, email address, or URI.
Does this tool verify the CSR signature or private key?
No. It displays the public key and signature algorithm but does not verify possession of the matching private key or make a trust decision. A private key is not needed to decode a public CSR, and PRIVATE KEY blocks are refused without displaying their contents.
What happens to challengePassword?
The decoder reports only whether a challengePassword attribute is present. It never displays or copies the value, because that value may be sensitive and modern CA workflows may not use it. Review CA-specific requirements in the CA's own documentation.
What does the SHA-256 CSR fingerprint mean?
It is a digest of the complete DER-encoded CSR, useful for comparing whether two PEM or DER files contain exactly the same request. It is not a certificate fingerprint, an approval result, proof of identity, or a substitute for certificate-authority validation.

What else can I open?

These tools run in your browser. Page Utils does not store, upload, or write to localStorage the keys, tokens, or text you paste. Results are a convenience aid, not legal, tax, or security advice.