SSL Certificate Decoder (X.509 / PEM)
Paste a PEM certificate and read it: subject, issuer, expiry, SANs, key, fingerprints and extensions — decoded in your browser.
Certificates only. Never paste a private key into a web page — not this one, not any other.
Paste a certificate or drop a file to decode it.
How to use
- Paste the PEM text, or drop a .pem, .crt, .cer or .der file.
- Read the expiry badge first — it counts the days left, or says the certificate has expired.
- Check the subject alternative names: those, not the common name, are what a browser matches.
- Compare a fingerprint when you need to confirm two copies are the same certificate.
- Paste a full chain to see the leaf and its issuers decoded together.
About this tool
ShowHide
A certificate is a DER-encoded structure wrapped in base64, which means the two questions people actually have — when does this expire, and which host names does it cover — are unreadable without a tool. The usual answer is openssl x509 -text, which is fine if you have a terminal and the file on that machine.
This decoder does the same reading in the browser. It shows the subject and issuer, whether the certificate is self-signed, the validity window with the days left counted for you, the serial number, the signature and public key algorithms with key size or curve, the SHA-256 and SHA-1 fingerprints, and the extensions that matter: subject alternative names, basic constraints, key usage and extended key usage, plus the CRL and OCSP URLs when they are there.
Paste a whole chain and every certificate in it is decoded in order, which is the quick way to see whether the intermediate you were sent actually issued the leaf. Nothing is uploaded — the parsing happens in your browser, and the fingerprints are computed with the browser's own crypto.
Frequently asked questions
Why does my certificate not match the host name?
Browsers match against the subject alternative names, not the common name — CN has been ignored for that purpose for years. If the host you are serving is not in the SAN list shown here, the certificate does not cover it, whatever the CN says.
What is the fingerprint for?
It is a hash of the whole encoded certificate, so it identifies that exact certificate. Comparing fingerprints is how you confirm the file you have is the one someone else is looking at, or that a pinned certificate has not been swapped.
Can it tell me whether the certificate is trusted?
No. Trust depends on the chain up to a root your system already trusts, and on revocation, neither of which can be checked from a single pasted file. This tool tells you what the certificate says about itself.
What does self-signed mean here?
The subject and issuer are identical, so the certificate vouches for itself. That is normal for a root CA and for local development, and it is why a browser refuses a self-signed certificate on a public site.
Can I paste a private key?
Do not. This tool only reads certificates, which are public by design. A private key should never be pasted into any web page, this one included — nothing here is uploaded, but the habit is what gets keys leaked.
Is my certificate uploaded anywhere?
No. It is decoded in your browser, and the fingerprints are computed with the browser's built-in crypto. Nothing is sent to a server.
Related tools
CRL Decoder (X.509)
Read a certificate revocation list in your browser: issuer, CRL number, validity window, every revoked serial with its reason, and the signature.
Developer
CSR Decoder (PKCS#10)
Read a certificate signing request before you send it: subject, SANs, key size, signature algorithm, and whether its self-signature verifies.
Developer
CAA Record Builder (DNS Certificate Authority Authorization)
Generate Certificate Authority Authorization (CAA) DNS records so only the CAs you trust can issue TLS certificates for your domain.
Network
TLSA Record Generator (DANE) & Checker
Turn a certificate into its TLSA records — every selector and matching type — and check an existing record against the certificate you are serving.
Network
DNS Zone File Validator
Paste a BIND zone file and see what it really says: every name fully qualified, the SOA explained, and the traps a parser alone will not report.
Network
RSS & Atom Feed Viewer
Paste a feed and read it: entries, dates normalised, podcast enclosures, and the problems that make readers drop or duplicate posts.
Network