About this tool
An SSL/TLS certificate tells you at a glance which domains it covers, who issued it and when it expires – if you can read it. This decoder lays out the content of X.509 certificates and certificate signing requests (CSRs): subject and issuer, validity period with time remaining, all subject alternative names (SAN), key type and size, signature algorithm and the SHA-256 and SHA-1 fingerprints.
Paste a single certificate, a whole chain (several PEM blocks in a row, e.g. from a fullchain.pem) or a CSR before you send it to your certificate authority. Binary DER files (.der, .cer) are converted to PEM when you open them. Extensions such as key usage, extended key usage, basic constraints, certificate policies and OCSP and CRL addresses are shown in readable form.
Everything runs in your browser; nothing is uploaded. Private keys are refused on purpose. Create a new SSH key pair with the SSH Key Generator, inspect tokens with the JWT Decoder.
How it works
- Paste the certificate in PEM format (starting with -----BEGIN CERTIFICATE-----) or open a .crt, .pem, .der or .csr file.
- Read the status and time remaining at the top, then subject, issuer, SANs, key and fingerprints.
- Expand “All extensions” to see every extension with its OID and critical flag.
- For a chain, each entry shows which other certificate in the chain issued it.
Frequently asked questions
Is it safe to paste my certificate here?
Yes. Certificates and CSRs are public data – every browser receives your certificate when it connects anyway. Decoding still runs only locally in your browser. Never paste a private key; the tool detects PRIVATE KEY blocks and refuses them.
Does the tool check whether the certificate is trusted?
No. It shows the content but does not verify signatures against trusted root certificates or query the revocation status (OCSP/CRL). Whether a certificate matches its issuer in a chain is shown by the “Issued by no. …” note, which is based on matching names.
How do I get a website’s certificate?
In the browser via the padlock icon in the address bar (“Connection is secure” → certificate), then export it. On the command line: openssl s_client -connect example.com:443 -showcerts. Paste the output between BEGIN and END directly.
What is the difference between PEM and DER?
DER is the binary encoding of a certificate; PEM is the same bytes as Base64 text between BEGIN and END lines. Both are read here; a DER file is converted to PEM when opened, so you can copy it right away.
What do I need the fingerprint for?
The SHA-256 fingerprint uniquely identifies a certificate, e.g. for certificate pinning or to check that two servers use the same certificate. It is the hash of the DER bytes – openssl x509 -noout -fingerprint -sha256 returns the same value.