ASN.1 / DER Decoder
Certificates get a dedicated reader, but everything else encoded in DER does not: a certificate signing request, a PKCS#8 key, a PKCS#7 bundle, an OCSP response, a timestamp token. They are all the same shape underneath — nested tagged values with explicit lengths — and this shows that shape for any of them. Every node reports where it starts, how long its header is, how many bytes of content follow, and whether it is constructed or primitive, which is what makes a structural problem visible. A length that overruns its parent, bytes left over after the outermost value, an indefinite length that should not be there in DER: none of those are apparent once the bytes have been turned into friendly names, and all of them are the reason a library rejects a file that looks fine. Primitives are decoded rather than dumped: object identifiers are named where they are well known, strings are decoded by their tag's own character set, integers are shown in full, and a BIT STRING reports its padding. An OCTET STRING that turns out to contain more DER — which is how certificate extensions and key blobs are carried — is marked, and can be expanded in place. Nothing is uploaded, which matters here because these blobs are keys as often as they are certificates.
Certificate extensions and key blobs nest another structure inside a string; this opens it in place.
Everything is decoded in your browser. Nothing is sent anywhere — but a private key is still better inspected with a local tool.
Paste a PEM block, base64 or hex to decode it.
How to use
- Paste a PEM block, or base64, or hex — or drop a .der file.
- Read the tree: offset, header length, content length, tag and value.
- Turn on expansion to open the DER hidden inside OCTET and BIT STRINGs.
- Watch for a trailing-bytes note: it means the file holds more than one structure.
- Copy the listing when you want to compare it against another tool's output.
Frequently asked questions
- How is this different from the certificate decoder?
- The certificate decoder understands what an X.509 certificate means — subject, expiry, alternative names. This one understands only the encoding, which is why it works on a CSR, a key, a PKCS#7 bundle or anything else in DER, and why it shows offsets and lengths instead of field names.
- What are the numbers before each line?
- The offset of the value in the file, then the length of its header and the length of its contents. Together they let you find any node in a hex dump, and they are how you spot a length that does not fit inside its parent.
- Why is an OCTET STRING marked as containing DER?
- Because parsing its contents as DER consumed them exactly, which almost always means another structure is nested inside — certificate extensions and key material are carried that way. It is still a guess, so it is marked rather than assumed, and expanding it is optional.
- What does an indefinite length mean?
- That the value runs until an end-of-contents marker instead of declaring its size. BER allows it, DER does not, so seeing it in something that should be DER usually explains why a strict parser refused the file.
- Can I paste a private key?
- The structure of one will decode, since it is DER like anything else, and nothing is uploaded. Even so, a private key is better inspected with a local tool — the habit of pasting keys into web pages is what eventually leaks one.
- Are the values verified?
- No. This reads the encoding, not the meaning: it will not check a signature, a chain or an expiry date. It tells you what the bytes say.
Related tools
MessagePack Decoder
Paste base64 or hex MessagePack bytes and read the values — types, nested maps, binary blobs and timestamps — decoded in your browser.
JWT Decoder
Decode a JSON Web Token to inspect its header, claims, and expiration.
Protobuf Decoder (no .proto needed)
Paste base64 or hex protobuf bytes and read the fields — numbers, wire types, nested messages, strings and packed arrays — without a schema.
Base64 Encoder / Decoder
Encode text to Base64 or decode Base64 back to text, instantly.
Quoted-Printable Encoder & Decoder
Encode text to MIME Quoted-Printable (RFC 2045) or decode it back — handling =XX escapes, soft line breaks, and UTF-8 — entirely in your browser, with 76-character line wrapping on encode.
URL Encoder / Decoder
Percent-encode text for URLs, or decode encoded URLs back to text.