Certificate decoder
Read PEM certificates and certificate requests: subject, issuer, validity, alternative names, public key, key usages, other extensions and fingerprints.
Process locally
Files stay in this browser session. Closing or clearing releases them.
Add text
Type or paste the text to process
Adjust settings
Nothing to set; defaults work
This tool has no settings.
Run
Processes in this browser; cancel at any time
About this tool
Decode X.509 certificates and certificate signing requests (CSRs) to see who a certificate was issued to, who issued it, when it expires and which host names it covers. Use it to check a certificate before you install it on a server, to confirm a CSR before you send it to a CA, or to compare fingerprints.
Paste PEM text with one or more certificates or requests, such as a full chain; bare Base64 is read as one certificate. The JSON result lists the subject, issuer, validity and days remaining, alternative names, public key, key usages, other extensions and the SHA-256 and SHA-1 fingerprints. Decoding runs in your browser and nothing is uploaded.
How to use it
- Paste the PEM text, from the -----BEGIN CERTIFICATE----- line to the END line, or select Use example to load the ISRG Root X1 root certificate.
- There are no settings to adjust. Select Run.
- Preview certificates.json, which has one entry per certificate or request, and download it if you want to keep it.
Formats and limits
- Input
- Text
- Output
- JSON
- Size limit
- 1 MB
- Privacy
- Files stay in the current browser session. No file bytes are uploaded.
- Price
- Free, no sign-up
Common questions
Does it check that the certificate is trusted?
No. It decodes the fields but does not verify the signature or build a chain to a trusted root. “self_signed” only means the subject and issuer are the same, and “status” compares the validity dates with your device’s clock.
How do I decode a .cer or .der file?
PEM text can be pasted directly, even if its line breaks were lost. For a binary DER file, convert it with “Image or file to Base64” with “Add the data:…;base64, prefix” turned off, then paste the result; bare Base64 is read as one certificate.
How can I tell whether it is a DV, OV or EV certificate?
Look at certificate_policies: the CA/Browser Forum policies appear as DV, OV, EV or IV, while most other policies are listed by their OID.
Which host names does the certificate cover?
Host names and IP addresses are listed in subject_alt_names as entries such as DNS:example.com and IP:127.0.0.1. The CN is shown separately in subject.
How do I check the certificate a website is using?
This tool reads certificates you paste. To fetch and check the certificate a site serves, use “SSL certificate checker”, which looks it up through this site’s server.
Related tools
Self-signed certificate
Create a self-signed TLS certificate and private key for development and testing from host names and IP addresses, one per line. The key is generated in the browser.
PFX/P12 to PEM
Export the private key, certificates and public key from a PFX or P12 file as PEM, including files from OpenSSL 3 (AES) and older RC2 or 3DES ones.
Key pair generator
Generate RSA, ECDSA (P-256, P-384, P-521), Ed25519 or SM2 key pairs as PEM in PKCS #8 or traditional form, for JWT, TLS or encryption tests.
JWT decode
Show a JWT’s header, payload and readable issue, start and expiry times without checking the signature.
RSA and SM2 encryption and signatures
Encrypt, decrypt, sign or verify text with an RSA key (PEM: PKCS #1, PKCS #8, public key or certificate) or an SM2 key (hex or PEM). Keys stay in the browser and are never saved with workflows.
Caesar cipher and Morse code
Encrypt or decrypt with the Caesar cipher (any shift), ROT13, ROT47 or Atbash, or encode and decode international Morse code.