Certificate Decoder
Paste a PEM certificate or drop a .crt/.cer/.pem/.der file and this tool decodes it into plain text in your browser: the subject and issuer, validity period with the remaining days highlighted, Subject Alternative Names (SAN), serial number, signature algorithm, public key type and size, SHA-1 and SHA-256 fingerprints, and key usage / extended key usage.
Certificate or CSR
Supports PEM and binary DER, multiple certificates (chains) and CSRs. Paste or upload — decoding is automatic.
Related tools
What does the certificate decoder show?
Paste a PEM certificate or drop a .crt/.cer/.pem/.der file and this tool decodes it into plain text in your browser: the subject and issuer, validity period with the remaining days highlighted, Subject Alternative Names (SAN), serial number, signature algorithm, public key type and size, SHA-1 and SHA-256 fingerprints, and key usage / extended key usage. It mirrors what openssl x509 -noout -text would print.
Parsing happens entirely client-side with pkijs and asn1js — the certificate never leaves your browser and no request is made. Paste a full chain to inspect every certificate in turn, or paste a CSR (-----BEGIN CERTIFICATE REQUEST-----) to read its subject, SAN and public key before submitting it to a CA.
Frequently asked questions
Is my certificate uploaded anywhere?
This tool processes certificate or key inputs locally in the browser without sending them to a server for computation. Page-resource loading and tool computation are separate processes; inspect requests in the browser network panel.
Which formats are supported?
PEM (-----BEGIN CERTIFICATE----- or -----BEGIN CERTIFICATE REQUEST-----) and binary DER (.der/.cer). You can paste text or upload .crt/.cer/.pem/.der files. Paste several PEM blocks at once to decode a full certificate chain.
Do the fields match openssl?
Yes. Subject, issuer, validity, SAN, serial number and SHA-1 / SHA-256 fingerprints match openssl x509 -in cert.pem -noout -text and -fingerprint. The SHA-256 fingerprint is the hash of the full DER certificate.
How is the expiry status decided?
A certificate is marked Expired once the current time is past notAfter, Expiring soon when it expires within 30 days, and Valid otherwise. A certificate whose notBefore is in the future is marked Not yet valid.
References and result limitations
Local results depend on the input and selected options. Retain the input example, format and processing rules when citing a result, and verify the output. Keep keys and other sensitive material out of public examples.
These references explain protocol or format rules; they do not endorse results produced by this site.