Certificate Decoder
Parses a PEM or DER certificate or CSR and shows subject, SANs, validity, key usage and chain hints.
Decodes an X.509 certificate — a PEM block, a `.crt`/`.cer` file, or a whole chain — and shows the subject, issuer, validity window, key, fingerprints and the extensions that actually decide whether a browser will accept it.
The certificate is decoded in this tab by this page’s own ASN.1 reader. Nothing is uploaded, which is the point: a CSR, an internal CA or a key pasted by accident should never be posted to a stranger’s server to be read.
Drop a certificate, a bundle, a CSR or a public key
PEM or DER — .pem, .crt, .cer, .der, .csr, or an authorized_keys line. Or paste it below.
What this does not do
- It does not verify signatures. “Issued by” above is a match on names, not proof — anyone can write any issuer name into a certificate they make themselves.
- It does not know which authorities you trust. That lives in your operating system and your browser, and it is not readable from a web page.
- It does not check revocation. The OCSP and CRL addresses are shown so you can, but asking them is a network request this tool deliberately does not make.
For what a live server is actually serving — chain order, protocol versions, expiry — you need a connection to it: the SSL checker is the tool for that question.
How to use it
Paste the PEM or drop the file
A `-----BEGIN CERTIFICATE-----` block, several of them for a chain, or the DER bytes. Parsing happens in this tab.
Check the dates and the names
Validity is against your clock. The names that matter are in the Subject Alternative Name extension, not the Common Name — no browser has looked at CN since 2017.
Compare the fingerprint
The SHA-256 fingerprint is what a pinning configuration or a colleague on the phone will quote at you. It is over the whole certificate, so any change at all produces a different one.
Common questions
Does it check whether the certificate is trusted?
No. It reads what the certificate says about itself. Trust means chaining to a root your system already has, plus revocation, plus name matching against the host you connected to — none of which a decoder can do on its own.
The browser says the name does not match but the CN looks right.
Because the Common Name has been ignored for host matching since Chrome 58 in 2017. The hostname has to be in the Subject Alternative Name extension; a certificate with only a CN fails everywhere modern.
Is it safe to paste a certificate here?
A certificate is public by design — it is what a server hands to every client that connects. A private key is not, and this page has no use for one. If a PEM block says `PRIVATE KEY`, it does not belong in a web page at all.
Feed it from
JWKS Verifier
Fetches a JWKS endpoint, picks the key by kid and verifies a token’s signature and standard claims.
Key Pair Generator
Generates RSA, ECDSA or Ed25519 key pairs and exports them as PEM, JWK or OpenSSH.
SSH Key Generator
Generates an OpenSSH key pair with a comment and shows the fingerprint. The private key comes out unencrypted — add a passphrase locally with ssh-keygen -p.
SSL Certificate Checker
Connects to a host, shows the served chain, expiry, protocol and cipher support, and flags chain gaps.
Next
These accept what this tool produces, so the result can go straight in.
CSR Generator
Generates a certificate signing request and its private key from subject fields and SAN entries.
Key Pair Generator
Generates RSA, ECDSA or Ed25519 key pairs and exports them as PEM, JWK or OpenSSH.
Keystore Inspector
Opens PKCS#12, JKS or PEM bundles and lists the certificates, chains and key algorithms inside.
SSL Certificate Checker
Connects to a host, shows the served chain, expiry, protocol and cipher support, and flags chain gaps.
JSON ⇄ CSV
Flattens nested JSON into columns or rebuilds objects from a table, with a dot-path column naming rule.
JSON Diff
Compares two JSON documents structurally, ignoring key order and reporting added, removed and changed paths.