X.509 Certificate Decoder
Decode a PEM X.509 certificate into subject, issuer, validity dates, SAN hostnames, key usage, signature algorithm and its SHA-256 fingerprint.
You can also drop a certificate, bundle, CRL or key file onto the box.
Also reads a PKCS#7 bundle (.p7b), a certificate revocation list (CRL) and a public key. A complete block is decoded as soon as it is pasted.
What the X.509 certificate decoder does
Paste a PEM-encoded X.509 certificate and, as soon as its END line is in, it is decoded into readable fields: the version, subject, issuer, serial number, validity dates, subject alternative names, key usage, signature algorithm and the SHA-256 and SHA-1 fingerprints — plus whether it is in force now by this device’s clock, the public key (its algorithm, size and curve, and the key itself as PEM), and every extension the certificate carries. It also reads a PKCS#7 bundle, opening each certificate inside it, a certificate revocation list (CRL) with its revoked serials, and a bare public key. Everything is parsed locally in your browser with the Web Crypto API, so a certificate never leaves your device.
Reading a TLS/SSL certificate
Certificates are stored as Base64 wrapped between BEGIN and END CERTIFICATE lines, which hides the details inside. Decoding one lets you confirm the hostnames it covers via the SAN extension, when it expires, who issued it and the exact fingerprint you can compare against a known value.
Frequently asked questions
Which certificate formats are supported?
Paste a PEM certificate between the BEGIN and END CERTIFICATE lines. The raw Base64 (DER) body is also accepted, and Open file… reads a binary DER certificate (.der, .cer or .crt) as well as a PEM one. A pasted block can also be a PKCS#7 bundle, a CRL or a public key, and Open file… takes .p7b, .p7c, .crl and .pub files too. This tool reads public certificates, not private keys.
Does it verify the certificate or its trust chain?
Not the signature or the chain. It decodes and displays the fields so you can inspect them, and its Status row says whether the certificate is in force now, expired or not yet valid by this device’s clock — but it does not validate the signature or verify the issuer chain.
What does it show about the public key and the extensions?
The Public key row names the algorithm, its size and, for an elliptic-curve key, its curve — EC · 256-bit · P-256, or RSA · 2048-bit · e = 65537 — and the key itself follows as a PEM block with its own Copy key button. Below it, Extensions lists every extension in the certificate’s own order with its OID, marked critical where it is: Basic Constraints is written out as CA: false or CA: true with any path length, and an extension no library knows is shown by its OID with its bytes in hex.
Does it decode without pressing Decode, and can it read a PKCS#7 bundle or a CRL?
Yes. As soon as the box holds a whole block — a BEGIN line and its matching END line — it is decoded with no button; Decode, or Ctrl/⌘+Enter, is still there for a block typed by hand or a bare Base64 body. A PKCS#7 bundle opens into its certificates, each marked “from the PKCS#7 bundle”; a CRL gives its issuer, this and next update, signature algorithm and the revoked serials with their dates and reasons; and a public key gives the key and its PEM.
Can I drop a certificate file onto the page?
Yes. Drop a certificate, a PKCS#7 bundle, a CRL or a key file onto the box and it is read the way Open file… reads it — a binary DER certificate is turned into PEM, anything else is read as text with its encoding worked out — under the same size limit, and decoded at once. A file that is none of those is refused with “That is not a certificate, bundle, CRL or key file.”