Keystore Inspector
Opens PKCS#12, JKS or PEM bundles and lists the certificates, chains and key algorithms inside.
A `.p12` handed over by an operations team is opaque: you cannot see what is in it, whether the chain is complete, or when the leaf expires, without a command line and the right flags. This opens PKCS#12, JKS and PEM bundles and lists what is inside.
The certificate is decoded in this tab by this page’s own ASN.1 reader. Nothing is uploaded, which is the point: a CSR, an internal CA or a key pasted by accident should never be posted to a stranger’s server to be read.
Drop a certificate, a bundle, a CSR or a public key
PEM or DER — .pem, .crt, .cer, .der, .csr, or an authorized_keys line. Or paste it below.
What this does not do
- It does not verify signatures. “Issued by” above is a match on names, not proof — anyone can write any issuer name into a certificate they make themselves.
- It does not know which authorities you trust. That lives in your operating system and your browser, and it is not readable from a web page.
- It does not check revocation. The OCSP and CRL addresses are shown so you can, but asking them is a network request this tool deliberately does not make.
For what a live server is actually serving — chain order, protocol versions, expiry — you need a connection to it: the SSL checker is the tool for that question.
How to use it
Drop the bundle in
`.p12`/`.pfx`, `.jks` and PEM files are all read. A password-protected store needs its password to open the key material; the certificate parts are often readable without it.
Check the chain, not just the leaf
Each certificate is shown with subject, issuer, validity and key algorithm. A bundle that installs on your machine and fails on a server is usually one missing intermediate.
Confirm the key matches the certificate
The public key in the leaf and the private key in the store should agree. A mismatch is the other common reason an apparently valid bundle will not serve traffic.
Common questions
Is the keystore uploaded?
No. It is parsed in the browser, password included. A store contains a private key, so anything else would be indefensible.
Does it tell me the certificate is trusted?
No. It reads what the file says. Trust depends on the root store of whatever will validate it and on revocation status, neither of which is in the file. This is an inspector, not a validator.
The password is rejected but I am sure it is right.
Old JKS files and PKCS#12 files written by legacy tooling sometimes use algorithms modern browsers do not implement, and a store can have a separate password for the store and for each key. Try the key password as well.
Feed it from
Certificate Decoder
Parses a PEM or DER certificate or CSR and shows subject, SANs, validity, key usage and chain hints.
File Encrypt & Decrypt
Encrypts any file with AES-256-GCM from a passphrase, and decrypts files it produced.
Metadata Scrubber
Removes author, device, GPS and revision metadata from documents, images, audio and video in one pass.
PGP Message Tool
Encrypts and decrypts OpenPGP messages with a passphrase, entirely in the browser — RFC 4880 symmetric mode (AES-256, SHA-256 S2K, MDC), interoperable with gpg -c. Public-key encryption and signatures are not built.
Next
These accept what this tool produces, so the result can go straight in.
Certificate Decoder
Parses a PEM or DER certificate or CSR and shows subject, SANs, validity, key usage and chain hints.
CSR Generator
Generates a certificate signing request and its private key from subject fields and SAN entries.
Key Pair Generator
Generates RSA, ECDSA or Ed25519 key pairs and exports them as PEM, JWK or OpenSSH.
SSL Certificate Checker
Connects to a host, shows the served chain, expiry, protocol and cipher support, and flags chain gaps.
CORS Tester
Sends the preflight a browser would send from a chosen origin plus a GET with that Origin, and explains by the Fetch standard’s rules exactly which header blocked it.
Currency Converter
Converts between about thirty currencies at the ECB’s daily reference rates, crossed through the euro, or at a rate you type in.