CSR Decoder — Inspect a PKCS#10 Certificate Signing Request
Decode a PEM or Base64 CSR (PKCS#10) to read its subject DN, subject alternative names, key algorithm and size, and signature algorithm. Free, no upload.
🔒 Your CSR is parsed entirely in your browser — nothing is uploaded.
What the CSR decoder does
Paste a PEM- or Base64-encoded Certificate Signing Request (PKCS#10) and it is decoded into readable fields: the subject distinguished name, the Subject Alternative Names it requests, the public-key algorithm and size (RSA or EC), and the signature algorithm the request is self-signed with. Everything is parsed locally in your browser with asn1js and PKI.js — the same parser stack as the X.509 certificate decoder — so a CSR never leaves your device.
Why inspect a CSR before you send it
A CSR is what you hand to a Certificate Authority to request a TLS certificate, and it is opaque Base64 once generated. Decoding it lets you confirm — before you pay for or deploy a certificate — that the common name and every SAN hostname are spelled correctly, that the key is the size you intended, and that no field was mistyped. Catching a wrong hostname here saves a costly reissue later.
Frequently asked questions
Is my CSR uploaded anywhere?
No. The request is decoded entirely in your browser with asn1js and PKI.js. Nothing is uploaded, so it is safe to inspect a CSR generated for a production certificate.
What formats are accepted?
Paste a PEM CSR between the BEGIN and END CERTIFICATE REQUEST lines, or the raw Base64 (DER) body on its own. This tool reads the public certification request, never the private key.
Does it verify the signature or the requested extensions?
No. It decodes and displays the fields — subject, SANs, key algorithm and size, and signature algorithm — so you can inspect them. It does not verify the self-signature or contact a Certificate Authority.