X.509 Certificate Decoder
Decode a PEM X.509 or SSL/TLS certificate — subject, issuer, validity, SAN, key usage, signature algorithm and SHA-256 fingerprint. Free, no upload.
🔒 Your certificate is parsed entirely in your browser — nothing is uploaded.
What the X.509 certificate decoder does
Paste a PEM-encoded X.509 certificate and it is decoded into readable fields: subject, issuer, serial number, validity dates, subject alternative names, key usage, signature algorithm and the SHA-256 fingerprint. Everything is parsed locally in your browser with the Web Crypto API, so a certificate never leaves your device.
Reading a TLS/SSL certificate
Certificates are stored as Base64 wrapped between BEGIN and END CERTIFICATE lines, which hides the details inside. Decoding one lets you confirm the hostnames it covers via the SAN extension, when it expires, who issued it and the exact fingerprint you can compare against a known value.
Frequently asked questions
Is my certificate uploaded anywhere?
No. The certificate is decoded entirely in your browser and the SHA-256 fingerprint is computed locally with the Web Crypto API. Nothing is uploaded.
Which certificate formats are supported?
Paste a PEM certificate between the BEGIN and END CERTIFICATE lines. The raw Base64 (DER) body is also accepted. This tool reads public certificates, not private keys.
Does it verify the certificate or its trust chain?
No. It decodes and displays the fields so you can inspect them. It does not check expiry against the current time, validate the signature or verify the issuer chain.