ASN.1 Decoder
Decode ASN.1 DER/BER — paste PEM, Base64, or hex and see the tag–length–value tree behind X.509 certificates, keys, and CMS, entirely in your browser.
Prefer the terminal? See the CLI equivalent →About the ASN.1 Decoder
- Tag–length–value tree with offsets
- Resolves common OIDs
- PEM, Base64, or hex input
- Instant results
- 100% private — runs in your browser
- Free, no sign-up
ASN.1 (Abstract Syntax Notation One) is the schema language behind much of the security world — X.509 certificates, RSA and EC keys, PKCS structures, CMS/PKCS#7, and OCSP are all defined in ASN.1 and serialized with the DER or BER encoding rules. That encoding is a nested series of tag–length–value (TLV) triples, which is compact but impossible to read as raw bytes.
This decoder turns those bytes back into a readable tree. Paste a PEM block, Base64, or hex (spaces and colons are fine) and it shows every element with its byte offset, tag (SEQUENCE, INTEGER, OBJECT IDENTIFIER, BIT STRING, UTCTime, and so on), length, and decoded value — integers in decimal and hex, object identifiers with their friendly names, strings and dates in readable form. Everything runs locally in your browser using the same asn1js engine behind the Certificate Decoder, so the data you paste is never uploaded.
Constructed elements (SEQUENCE, SET, context-specific tags) nest, and OCTET or BIT strings that themselves wrap ASN.1 — like the public key inside a SubjectPublicKeyInfo — are expanded automatically, so you can drill all the way down. Copy any node’s raw bytes as hex to work with just that fragment.
How to use it
- Paste an ASN.1 structure as PEM, Base64, or hex — the format is detected automatically.
- Read the tree: each row shows the byte offset, the tag/type, its length, and the decoded value.
- Expand or collapse the whole tree, and drill into nested SEQUENCEs and wrapped keys.
- Copy any node’s bytes (hex) with the ⧉ button to isolate a fragment.
Common ASN.1 types
- SEQUENCE / SET
- Constructed containers — an ordered (SEQUENCE) or unordered (SET) list of elements that nest.
- INTEGER
- A whole number; big values (like an RSA modulus) are shown by bit length and hex.
- OBJECT IDENTIFIER
- A dotted number identifying an algorithm or attribute (e.g. 2.5.4.3 = commonName), shown with its name.
- BIT STRING / OCTET STRING
- Raw bytes; when they contain further ASN.1 (a wrapped key or extension) the decoder recurses into them.
- UTCTime / GeneralizedTime
- Timestamps, parsed to a readable date — used for certificate validity.
Frequently asked questions
Is my data uploaded anywhere?+
No. Decoding happens entirely in your browser with the asn1js library — there is no server and nothing is uploaded, so it is safe to inspect private keys and certificates.
What input formats are accepted?+
PEM (any -----BEGIN…----- block), Base64, or hex — spaces and colons in hex are ignored. The format is detected automatically; you can paste a certificate, a key, or any raw DER/BER fragment.
Does it decode certificates and keys specifically?+
It shows the raw ASN.1 structure of anything DER/BER-encoded, including certificates and keys. For a certificate-specific view (subject, issuer, validity, extensions, fingerprints), use the Certificate Decoder — this tool is the low-level structural view underneath it.
Can it encode ASN.1 as well?+
Not yet — this is a decoder/inspector. Building DER from scratch is a separate, more specialised task; for now the tool focuses on reading existing structures.
Why are some OCTET/BIT strings shown as a sub-tree?+
Because their content is itself ASN.1. A SubjectPublicKeyInfo, for example, stores the actual public key inside a BIT STRING; the decoder detects that the bytes parse cleanly and expands them so you can see the structure within.
Related tools
Certificate Decoder
Decode X.509 / PEM certificates — view subject, issuer, validity, SANs, key, and fingerprints, all in your browser.
Hash Generator
Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes of text or a file, plus HMAC — all at once, entirely in your browser.
JWT Debugger
Decode and inspect JSON Web Tokens: view the header and payload, check expiry, and verify HS/RS/PS/ES signatures — all in your browser.
JWT Signer
Build a JWT header and payload and sign it with HMAC (HS256/384/512) or an RSA/ECDSA private key (RS/PS/ES) — entirely in your browser. Nothing is uploaded.
Metadata Inspector
Inspect the hidden metadata in a photo or document — EXIF, GPS location, author, dates, and more — right in your browser. Download a cleaned copy with the metadata removed.
Metadata Stripper
Strip EXIF, GPS, author, and hidden metadata from images and documents in one batch — locally in your browser. JPEG, PNG, WebP, GIF, PDF, Office, OpenDocument & EPUB.