SSL Certificate Decoder (X.509 / PEM)
A certificate is a DER-encoded structure wrapped in base64, which means the two questions people actually have — when does this expire, and which host names does it cover — are unreadable without a tool. The usual answer is openssl x509 -text, which is fine if you have a terminal and the file on that machine. This decoder does the same reading in the browser. It shows the subject and issuer, whether the certificate is self-signed, the validity window with the days left counted for you, the serial number, the signature and public key algorithms with key size or curve, the SHA-256 and SHA-1 fingerprints, and the extensions that matter: subject alternative names, basic constraints, key usage and extended key usage, plus the CRL and OCSP URLs when they are there. Paste a whole chain and every certificate in it is decoded in order, which is the quick way to see whether the intermediate you were sent actually issued the leaf. Nothing is uploaded — the parsing happens in your browser, and the fingerprints are computed with the browser's own crypto.
Certificates only. Never paste a private key into a web page — not this one, not any other.
Paste a certificate or drop a file to decode it.
How to use
- Paste the PEM text, or drop a .pem, .crt, .cer or .der file.
- Read the expiry badge first — it counts the days left, or says the certificate has expired.
- Check the subject alternative names: those, not the common name, are what a browser matches.
- Compare a fingerprint when you need to confirm two copies are the same certificate.
- Paste a full chain to see the leaf and its issuers decoded together.
Frequently asked questions
- Why does my certificate not match the host name?
- Browsers match against the subject alternative names, not the common name — CN has been ignored for that purpose for years. If the host you are serving is not in the SAN list shown here, the certificate does not cover it, whatever the CN says.
- What is the fingerprint for?
- It is a hash of the whole encoded certificate, so it identifies that exact certificate. Comparing fingerprints is how you confirm the file you have is the one someone else is looking at, or that a pinned certificate has not been swapped.
- Can it tell me whether the certificate is trusted?
- No. Trust depends on the chain up to a root your system already trusts, and on revocation, neither of which can be checked from a single pasted file. This tool tells you what the certificate says about itself.
- What does self-signed mean here?
- The subject and issuer are identical, so the certificate vouches for itself. That is normal for a root CA and for local development, and it is why a browser refuses a self-signed certificate on a public site.
- Can I paste a private key?
- Do not. This tool only reads certificates, which are public by design. A private key should never be pasted into any web page, this one included — nothing here is uploaded, but the habit is what gets keys leaked.
- Is my certificate uploaded anywhere?
- No. It is decoded in your browser, and the fingerprints are computed with the browser's built-in crypto. Nothing is sent to a server.
Related tools
CAA Record Builder (DNS Certificate Authority Authorization)
Generate Certificate Authority Authorization (CAA) DNS records so only the CAs you trust can issue TLS certificates for your domain. Builds BIND-format records and split tag/value rows for control-panel UIs, plus a one-click list of common CAs (Let's Encrypt, DigiCert, Google, Amazon, …).
RSS & Atom Feed Viewer
Paste a feed and read it: entries, dates normalised, podcast enclosures, and the problems that make readers drop or duplicate posts.
Sitemap.xml Validator & Inspector
Paste or load a sitemap.xml (or a sitemap-index .xml) and instantly see URL count, size, spec compliance, and distributions of changefreq, priority and host — entirely in your browser.
HTTP Basic Auth Encoder / Decoder
Encode `username:password` into the Base64 `Authorization: Basic` header — or paste an existing header back to see who's in it.
TLS Cipher Suite Decoder
Paste any IANA cipher suite name like TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 and get a breakdown into key exchange, authentication, bulk cipher, mode, and MAC — plus a security grade covering forward secrecy, AEAD, hash strength, and known-broken algorithms.
HTTP Status Code Reference
Searchable list of every HTTP status code (1xx-5xx) with summary, RFC, when to use, and common pitfalls.