DevTools

Certificate Decoder

Decode X.509 / PEM certificates — view subject, issuer, validity, SANs, key, and fingerprints, all in your browser.

Prefer the terminal? See the CLI equivalent →
Loading tool…

About the Certificate Decoder

  • Full X.509 field breakdown
  • Subject, SAN & validity
  • Syntax highlighting
  • Instant results
  • 100% private — runs in your browser
  • Free, no sign-up

An X.509 certificate binds a public key to an identity — a domain name, organisation, or person — and is signed by a certificate authority (CA) so that others can trust the binding. Certificates are the foundation of HTTPS/TLS: when you connect to a secure site, the server presents its certificate and your browser checks who issued it, whether it is still valid, and which names it covers.

This decoder parses a PEM-encoded certificate entirely in your browser and lays out the fields that matter when debugging: the subject and issuer, the validity window (not-before and not-after dates), the Subject Alternative Names, the public-key type and size, key usage and extended key usage, the serial number, and the SHA-1 and SHA-256 fingerprints. Paste a full chain and each certificate is decoded in turn, which makes it easy to see how a leaf certificate links up to its intermediate and root.

Because everything runs client-side, you can safely inspect internal or production certificates without sending them anywhere. The tool reads certificates; it does not contact the server or validate the chain against a live trust store.

How to use it

  1. Copy a certificate in PEM format — the block that begins with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----.
  2. Paste it into the editor — or load a .pem/.crt file with the ⬆ upload button in the toolbar. To inspect a chain, include all the concatenated PEM blocks.
  3. Read the decoded fields: check the validity dates for expiry, confirm the Subject Alternative Names cover the hostname you expect, and note the issuer to identify the CA.
  4. Compare the SHA-256 fingerprint against a known-good value when you need to pin or verify a specific certificate.

Key certificate fields

Subject
The identity the certificate is issued to (e.g. the domain in the Common Name).
Issuer
The certificate authority that signed and issued the certificate.
Validity
The not-before and not-after dates between which the certificate is considered valid.
SAN
Subject Alternative Names — the full list of hostnames or IPs the certificate is valid for. Modern browsers rely on this, not the Common Name.
Key usage
The operations the key may be used for, such as digital signatures or key encipherment.
Fingerprint
A SHA-1 or SHA-256 hash of the whole certificate, used to identify or pin it.

Frequently asked questions

What certificate format does this accept?+

PEM — the Base64 text format wrapped in -----BEGIN CERTIFICATE----- / -----END CERTIFICATE----- markers. If you have a binary DER (.cer/.der) file, convert it to PEM first (for example with openssl x509 -inform der -in cert.der -out cert.pem).

Can it decode an entire certificate chain?+

Yes. Paste the concatenated PEM blocks — leaf, intermediate, and root — and each certificate is decoded separately so you can trace the chain from the server certificate up to the CA.

Does it verify that the certificate is trusted?+

No. It decodes and displays the certificate contents. It does not check the signature against a trusted root store, confirm revocation, or contact the server, so it will happily decode expired or self-signed certificates for inspection.

Why does my certificate look expired?+

Compare the current date against the not-after date shown in the validity section. Certificates have a fixed lifetime and must be renewed before that date; an expired certificate causes browser trust warnings even if everything else is correct.

Is it safe to paste a private certificate?+

The certificate itself contains only public information and is safe to inspect. Parsing happens entirely in your browser with nothing uploaded. Never paste a private key, though — a certificate and its private key are different things, and the private key must stay secret.

Works well with

Certificate Decoder chains with these tools — send your result straight on:

JWT Debugger

Related tools

ASN.1 Decoder

Decode ASN.1 DER/BER — paste PEM, Base64, or hex and see the tag–length–value tree behind X.509 certificates, keys, and CMS, entirely in your browser.

Hash Generator

Compute MD5, SHA-1, SHA-256, SHA-384, and SHA-512 hashes of text or a file, plus HMAC — all at once, entirely in your browser.

JWT Debugger

Decode and inspect JSON Web Tokens: view the header and payload, check expiry, and verify HS/RS/PS/ES signatures — all in your browser.

JWT Signer

Build a JWT header and payload and sign it with HMAC (HS256/384/512) or an RSA/ECDSA private key (RS/PS/ES) — entirely in your browser. Nothing is uploaded.

Metadata Inspector

Inspect the hidden metadata in a photo or document — EXIF, GPS location, author, dates, and more — right in your browser. Download a cleaned copy with the metadata removed.

Metadata Stripper

Strip EXIF, GPS, author, and hidden metadata from images and documents in one batch — locally in your browser. JPEG, PNG, WebP, GIF, PDF, Office, OpenDocument & EPUB.