X.509 Certificate Decoder

How to decode a certificate

1. Paste a certificate into Certificate, chain or CSR (PEM or Base64), or drop a file on the drop zone. PEM text (-----BEGIN CERTIFICATE-----), binary DER (.der, .cer), a certificate signing request (.csr) and a PKCS#7 bundle (.p7b) are all accepted.
2. Click Decode. A pasted PEM block is also decoded as soon as its -----END …----- line is complete. Load an example shows a test certificate.
3. Each certificate or CSR gets its own table. A badge shows Valid dates, Expired or Not yet valid, and Copy PEM copies it back as PEM (handy after opening a binary DER file).
4. For a chain (a server certificate followed by its intermediates), every block is decoded in order, and the tool notes Issued by certificate n when a certificate’s issuer matches the subject of another one in the list.

What the fields mean

• Subject and Issuer are distinguished names: CN (common name), O (organization), OU, L (city), ST (state or province), C (country). A certificate whose issuer equals its subject is marked Self-signed.
• Valid from and Valid until are the notBefore and notAfter dates, shown in your time zone, with the number of days left. Since 2020, browsers reject public TLS certificates valid for more than 398 days, and the CA/Browser Forum is shortening that limit further.
• Serial number is shown in hexadecimal (as in browsers and OpenSSL) and in decimal.
• Signature algorithm and Public key: for RSA the modulus size (2048, 3072, 4096 bits) and the public exponent (almost always 65537); for elliptic curves the curve (P-256, P-384…); Ed25519 is also recognized.
• Extensions: Subject Alternative Name (the host names, IP addresses and e-mail addresses the certificate covers; browsers ignore the CN and only use the SAN), Key Usage, Extended Key Usage (serverAuth, clientAuth, codeSigning…), Basic Constraints (CA: TRUE for an authority), Subject and Authority Key Identifiers, CRL Distribution Points, Authority Information Access (OCSP responder and CA Issuers URL) and Certificate Policies (DV, OV, EV). Extensions marked critical must be understood by any software that uses the certificate.
• SHA-1 fingerprint and SHA-256 fingerprint are hashes of the whole DER certificate, computed with the browser’s Web Crypto API; they match openssl x509 -fingerprint. Public key pin is the Base64 SHA-256 of the public key info, the format used for certificate pinning.

Decoding is not verifying

This tool is a pure ASN.1/DER parser. It does not check the signature, does not build a trust chain to a root authority, and does not query revocation lists or OCSP, because that would require network access. Use it to inspect a certificate, find out why a host name does not match or when it expires, not to decide whether it can be trusted. Private keys are refused on purpose: if you paste a PRIVATE KEY block, it is not decoded, and you should treat it as exposed if you ever shared it.