Certificate Decoder

Read what a certificate actually says — who it is for, when it expires, and every extension — without it leaving your device.

0 bytes uploaded

Validity——Subject—Size—

Certificate — paste PEM, hex or Base64

Drop a .pem, .crt, .cer or .der file here — it stays on this device.

Subject

Subject distinguished name, attribute by attribute
Attribute	Value	DER string type
Paste or drop a certificate and its fields appear here.

Issuer

Issuer distinguished name, attribute by attribute
Attribute	Value	DER string type
Paste or drop a certificate and its fields appear here.

Subject Alternative Name entries

Paste or drop a certificate and its fields appear here.

—

Certificate details

Paste or drop a certificate and its fields appear here.

Fingerprints

SHA-256SHA-1

—

A fingerprint is a hash of the whole certificate, not of the public key.

0 characters · Format: auto

Reads one certificate up to 64 KB · Each table below is a scrollable region: press Tab to focus it, then the arrow keys to read it.

The pasted text is hidden below until you press Reveal, so a private key cannot be read over your shoulder while you work.

Nothing here is verified. The signature is not checked, no chain is built, and no revocation list is read — these are the fields as written, not a trust decision.

There is no host or URL field on this page: a browser cannot open a TLS connection to inspect another site's certificate, so this tool reads only what you paste.

Declared scope: RSA and ECDSA certificates. An Ed25519 public key is named when it appears, but no Ed25519 certificate has been checked in as a test vector yet.

Judged against this device's clock. A wrong clock changes this answer and nothing else.

A shared link carries the view and format settings above and nothing else — the certificate you pasted cannot travel in it.

What you paste is never stored — not in this browser, not anywhere else. This tool keeps no copy of it between visits.

This paste looks like credential-shaped text. It is not stored anywhere, and it cannot travel in a shared link — there is no field in the link for it.

Press ? for shortcuts

Do it offline:$ openssl x509 -in cert.pem -noout -text

How to use it

Paste the PEM block, drop the .pem, .crt, .cer or .der file, or paste raw DER as hex or Base64. The badge names the form that was detected; click it to pin a different one when the guess is wrong.
Read the instrument bar first: the validity verdict, carried by a word and a glyph rather than colour alone, the subject the certificate speaks for, and the size of the bytes you handed over.
Move between Fields, Extensions and Raw. Extensions keeps each critical marker beside its name, and its Bytes button opens that one extension's DER underneath — which is where an extension nobody recognises stays readable. Raw is the hex dump of the whole certificate.
Copy what you came for — a fingerprint, the subject or issuer name, the alternative-name list, one extension's DER as hex — or download the certificate as a .der file. A shared link carries your view settings and nothing else.

A certificate is a signed statement about a public key: who it is for, who vouched for it, and for how long. Open one here and every field it holds is printed — subject and issuer attributes, both validity timestamps, the key itself, the alternative names a browser matches a hostname against, and each extension with its criticality. The bytes are read on your device.

How it works

A certificate file is one ASN.1 structure serialised with Distinguished Encoding Rules, and DER is relentlessly regular: every value is a tag byte, a length, and that many content bytes, nested. PEM is only packaging — the fenced Base64 of RFC 7468, unwrapping to the DER a .der file holds. The outer SEQUENCE has three members (RFC 5280 §4.1): the tbsCertificate carrying everything a reader needs, the algorithm identifier the issuer signed with, and the signature. Walking the tbsCertificate in order yields version, serial, signature algorithm, issuer, validity, subject, subjectPublicKeyInfo and the extensions — each at a fixed position.

Extensions are where a modern certificate says what it is allowed to do, and each one is a triple of object identifier, a criticality flag, and an opaque octet string decoded on its own terms (RFC 5280 §4.2). Criticality is a promise to the software reading it: if the flag is set and the reader does not understand the identifier, it must reject the certificate. So an unrecognised extension is never quietly dropped here — identifier, critical marker and raw bytes all stay: the thing your own stack would have refused.

Text and time are where the encoding leaks into what you read. Directory strings come in several ASN.1 flavours — UTF8String is the modern one, PrintableString has a restricted alphabet, TeletexString is Latin-1 in practice, BMPString is UTF-16 — so the DER class is shown beside each attribute value, and control characters are escaped. Timestamps are worse: UTCTime keeps a two-digit year, and RFC 5280 §4.1.2.5.1 fixes the reading so 50 through 99 mean 1950 through 1999 while 00 through 49 mean 2000 through 2049. GeneralizedTime, with four digits, is required past 2049 and carries the 99991231235959Z that means no expiry.

Decoding is not trusting, and that difference matters more than anything above. These bytes tell you what a certificate claims; they cannot tell you the issuer's signature is real, that a chain reaches a root your device trusts, or that nobody has revoked it since. None of those checks happen here — no signature verified, no chain built, no revocation responder consulted, no host contacted — so a certificate a browser would reject decodes exactly as cleanly as one it accepts.

Examples

Version: v3
Serial: 803fe9bdea7de8cd (raw DER INTEGER 00803fe9bdea7de8cd)
Subject: C=GB, ST=Greater London, L=London, O=Ithomia Fixture Authority, OU=Golden Vectors, CN=fixture.example.com
Issuer: C=GB, ST=Greater London, L=London, O=Ithomia Fixture Authority, OU=Golden Vectors, CN=fixture.example.com (self-issued)
Not before: 2026-08-18T05:18:13.000Z (UTCTime 260818051813Z)
Not after: 2036-08-15T05:18:13.000Z (UTCTime 360815051813Z)
Read at 2027-01-01T00:00:00.000Z: valid (3514 days)
Public key: rsaEncryption (1.2.840.113549.1.1.1), 2048-bit modulus, exponent 65537
Signature algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)
SHA-256 fingerprint: 02e3cbd00f7691860efa0bf0c1f97f6ed3b209c7f1a56b1e99b913b6f2e86ffb
SHA-1 fingerprint: 6f694ddec7e9a232ef04c2cf5d54a64b64dd6bc0
Extensions: 9
  basicConstraints (2.5.29.19) — critical
    CA: true
    pathLenConstraint: 0
  keyUsage (2.5.29.15) — critical
    digitalSignature
    keyCertSign
    cRLSign
  extKeyUsage (2.5.29.37)
    serverAuth
    clientAuth
  subjectKeyIdentifier (2.5.29.14)
    keyid: 5D:45:DE:5A:0B:F8:A5:3B:7D:95:F0:2B:DE:E3:E3:F3:92:E1:24:F8
  authorityKeyIdentifier (2.5.29.35)
    keyid: 5D:45:DE:5A:0B:F8:A5:3B:7D:95:F0:2B:DE:E3:E3:F3:92:E1:24:F8
    issuer: DirName: C=GB, ST=Greater London, L=London, O=Ithomia Fixture Authority, OU=Golden Vectors, CN=fixture.example.com
    serial: 00:80:3F:E9:BD:EA:7D:E8:CD
  subjectAltName (2.5.29.17)
    DNS: fixture.example.com
    DNS: *.fixture.example.com
    DNS: xn--bcher-kva.example
    IP: 192.0.2.10
    IP: 2001:db8::1
    email: pki@example.com
    URI: https://fixture.example.com/statement
    otherName: userPrincipalName: fixture@example.com
  cRLDistributionPoints (2.5.29.31)
    URI: http://crl.example.com/fixture.crl
  authorityInfoAccess (1.3.6.1.5.5.7.1.1)
    OCSP: URI: http://ocsp.example.com
    caIssuers: URI: http://ca.example.com/ca.crt
  certificatePolicies (2.5.29.32)
    policy: 2.23.140.1.2.1
      CPS: https://example.com/cps

The everyday case: a 2048-bit RSA certificate with the full PKIX extension set. Hostname matching reads subjectAltName, not the common name, so the wildcard, the punycode label, both address forms and the user-principal otherName appear in DER order.

Version: v3
Serial: ad7998e9526892d0 (raw DER INTEGER 00ad7998e9526892d0)
Subject: C=US, O=Ithomia Fixture Authority, CN=ec.fixture.example.com
Issuer: C=US, O=Ithomia Fixture Authority, CN=ec.fixture.example.com (self-issued)
Not before: 2026-08-18T05:18:13.000Z (UTCTime 260818051813Z)
Not after: 2036-08-15T05:18:13.000Z (UTCTime 360815051813Z)
Read at 2027-01-01T00:00:00.000Z: valid (3514 days)
Public key: id-ecPublicKey (1.2.840.10045.2.1), curve P-256
Signature algorithm: ecdsa-with-SHA256 (1.2.840.10045.4.3.2)
SHA-256 fingerprint: bfd67ed47d4529e31993d46caa801bdb204d1e6722e1ca2efd72b944f6a21f29
SHA-1 fingerprint: 3d320a88a2282e19d97b51cb154c2f249534d197
Extensions: 4
  basicConstraints (2.5.29.19)
    CA: false
  keyUsage (2.5.29.15) — critical
    digitalSignature
  extKeyUsage (2.5.29.37)
    serverAuth
  subjectAltName (2.5.29.17)
    DNS: ec.fixture.example.com

The same fixture authority signing with elliptic curve instead. The public-key row names the curve from its object identifier — prime256v1, labelled P-256 by RFC 5480 — and the signature row records ecdsa-with-SHA256. A four-extension leaf like this is close to what most TLS servers present.

Version: v3
Serial: 01 (raw DER INTEGER 01)
Subject: CN=multi.example.com+OU=Second Half, CN=duplicate.example.com, O=Café Latin-1, L=東京, C=GB, OU=before\x00after, serialNumber=1234567890
Issuer: CN=Fixture Root
Not before: 2026-01-01T00:00:00.000Z (UTCTime 260101000000Z)
Not after: 2036-01-01T00:00:00.000Z (UTCTime 360101000000Z)
Read at 2027-01-01T00:00:00.000Z: valid (3287 days)
Public key: rsaEncryption (1.2.840.113549.1.1.1), 2048-bit modulus, exponent 65537
Signature algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)
SHA-256 fingerprint: 3f3697991aec55531cd8727457887c8473f92e342aafa8b5674a06142e5d3ba3
SHA-1 fingerprint: b3841e5c31b53b10407c915d85dcfa5388141826
Extensions: 1
  basicConstraints (2.5.29.19)
    CA: false

Edge case one, minted to be awkward: a multi-valued first attribute set joined with +, a second common name, a Latin-1 TeletexString, a UTF-16 BMPString, an embedded NUL printed as an escape rather than swallowed, and a NumericString serial number. The DER string class is printed beside every value.

MIIClzCCAmGgAwIBAgIBCjANBgkqhkiG9w0BAQsFADAVMRMwEQYDVQQDEwpIb3N0
aWxlIENBMB4XDTI2MDEwMTAwMDAwMFoXDTM2MDEwMTAwMDAwMFowADCCASIwDQYJ
KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMQlSm+Uud4DKE1yl7zhBitQdZq/5Aku
U3idwucMMVZ7oMXqDzRZfqPI7RI3XIGmy/AVOl+Eqc7zGD1ih6zR9htAZYqv1Pke
Q2iNstf8IUZrkLXa/yRJbpO43QInTHGWu+AFKk90mb7jCC1Sd5zB5gswVXqfxOkO
M1h9osfsETZbgKXK7xQ5XoOozfIXPGGGq9D1Gj9kia7T+B1CZ4yx1vsgRWqPtNn+
I0htkrfcASZLcJW63wQpTnOYveIHLFF2m8DlCi9UeZ7D6A0yV3yhxusQNVp/pMnu
EzhdgqfM8RY7YIWqz/QZPmOIrdL3HEFmi7DV+h9EaY6z2P0iR2yRttsCAwEAAaOB
6DCB5TB9BgNVHREBAf8EczBxgg52Ni5leGFtcGxlLmNvbYcQIAENuAAAAAAAAAAA
AAAAAYcEwAACCqQbMBkxFzAVBgNVBAMTDkRpcmVjdG9yeSBOYW1liAkqhkiG9w0B
CQGgHwYKKwYBBAGCNxQCA6ARDA91cG5AZXhhbXBsZS5jb20wDgYDVR0PAQH/BAQD
AgeAMAkGA1UdJQQCMAAwDwYDVR0TAQH/BAUwAwEB/zAiBgNVHSMEGzAZoRSCEmlz
c3Vlci5leGFtcGxlLmNvbYIBCjAUBgcqAwQFBgcIAQH/BAYEBN6tvu8wDQYJKoZI
hvcNAQELBQADIQAFEBsmMTxHUl1oc36JlJ+qtcDL1uHs9wINGCMuOURPWg==

Version: v3
Serial: 0a (raw DER INTEGER 0a)
Subject: (empty)
Issuer: CN=Hostile CA
Not before: 2026-01-01T00:00:00.000Z (UTCTime 260101000000Z)
Not after: 2036-01-01T00:00:00.000Z (UTCTime 360101000000Z)
Read at 2027-01-01T00:00:00.000Z: valid (3287 days)
Public key: rsaEncryption (1.2.840.113549.1.1.1), 2048-bit modulus, exponent 65537
Signature algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)
SHA-256 fingerprint: 8af432664cd237352a2b749cb85b9c7d94e84db04a4bd77aa23ba974efce3479
SHA-1 fingerprint: f7ee6bf02cbdd0ad85f11c3ab4e5b33d1a50cd83
Extensions: 6
  subjectAltName (2.5.29.17) — critical
    DNS: v6.example.com
    IP: 2001:db8::1
    IP: 192.0.2.10
    DirName: CN=Directory Name
    Registered ID: 1.2.840.113549.1.9.1
    otherName: userPrincipalName: upn@example.com
  keyUsage (2.5.29.15) — critical
    digitalSignature
  extKeyUsage (2.5.29.37)
  basicConstraints (2.5.29.19) — critical
    CA: true
  authorityKeyIdentifier (2.5.29.35)
    issuer: DNS: issuer.example.com
    serial: 0A
  unrecognised extension (1.2.3.4.5.6.7.8) — critical
Note T_WHITESPACE: Whitespace and line breaks were ignored

Edge case two, pasted as a bare Base64 body to show the form badge working without a fence. The subject is empty, so identity lives in a critical subjectAltName holding an IPv6 address, a directory name and a registered identifier; extKeyUsage lists nothing; and an unrecognised critical extension keeps its identifier and bytes.

308201d9308201a3a003020102020103300d06092a864886f70d01010b050030
133111300f060355040313085069766f74204341301e170d3530303130313030
303030305a170d3530313233313233353935395a3020311e301c060355040313
157069766f742d7072652e6578616d706c652e636f6d30820122300d06092a86
4886f70d01010105000382010f003082010a0282010100c4254a6f94b9de0328
4d7297bce1062b50759abfe4092e53789dc2e70c31567ba0c5ea0f34597ea3c8
ed12375c81a6cbf0153a5f84a9cef3183d6287acd1f61b40658aafd4f91e4368
8db2d7fc21466b90b5daff24496e93b8dd02274c7196bbe0052a4f7499bee308
2d52779cc1e60b30557a9fc4e90e33587da2c7ec11365b80a5caef14395e83a8
cdf2173c6186abd0f51a3f6489aed3f81d42678cb1d6fb20456a8fb4d9fe2348
6d92b7dc01264b7095badf04294e7398bde2072c51769bc0e50a2f54799ec3e8
0d32577ca1c6eb10355a7fa4c9ee13385d82a7ccf1163b6085aacff4193e6388
add2f71c41668bb0d5fa1f44698eb3d8fd22476c91b6db0203010001a30d300b
30090603551d1304023000300d06092a864886f70d01010b050003210005101b
26313c47525d68737e89949faab5c0cbd6e1ecf7020d18232e39444f5a

Version: v3
Serial: 03 (raw DER INTEGER 03)
Subject: CN=pivot-pre.example.com
Issuer: CN=Pivot CA
Not before: 1950-01-01T00:00:00.000Z (UTCTime 500101000000Z)
Not after: 1950-12-31T23:59:59.000Z (UTCTime 501231235959Z)
Read at 2027-01-01T00:00:00.000Z: expired (27759 days)
Public key: rsaEncryption (1.2.840.113549.1.1.1), 2048-bit modulus, exponent 65537
Signature algorithm: sha256WithRSAEncryption (1.2.840.113549.1.1.11)
SHA-256 fingerprint: ffa0afdd3702c8275613b752d6508e23f5b645e29eafe16defcc470c37640c59
SHA-1 fingerprint: 8c1c6a71077572e59d14258ae7ede6169486258e
Extensions: 1
  basicConstraints (2.5.29.19)
    CA: false
Note T_SEPARATORS: Separators (colons/spaces/commas/line breaks) were ignored

Raw DER pasted as hex, which needs no fence at all. Both timestamps are UTCTime with a two-digit year of 50, which RFC 5280 pins to 1950 rather than 2050. The verdict is read at the instant printed in its row, so this page cannot drift; the tool uses your own device clock there.

This is a -----BEGIN CERTIFICATE REQUEST----- block, not a certificate. A certificate block is labelled CERTIFICATE. A certificate signing request is decoded by the CSR decoder.

The refusal you are likeliest to meet. A signing request is a different structure that happens to share the PEM packaging, so the decoder names the label it found and stops rather than half-reading it. Nothing about the paste is stored or sent.

Every example on this page is executed against the same engine that powers the tool, on every build.

Gotchas worth knowing

More than one block in a paste

A file holding a chain, or a certificate followed by its key, is read from the top: the first block is decoded and a note states how many were found and which one was chosen, so nothing is silently ignored. A private-key block among them is masked, left undecoded and called out plainly, because text like that is worth treating as exposed once it has been pasted anywhere at all.

Serial numbers are printed twice on purpose

A serial is an ASN.1 INTEGER, so it is signed, and an issuer that wants twenty random bytes must prepend a zero when the first byte has its high bit set. One row shows the serial as a console prints it, with that padding byte gone; a second shows the raw INTEGER bytes as they sit in the DER. With the high bit set and no pad, the value is negative and is labelled so rather than reinterpreted.

The version number is one less than its name

The version field encodes 2 for a v3 certificate, 1 for v2 and 0 for v1, and it is optional: absent altogether means v1 (RFC 5280 §4.1.2.1). A v1 certificate carries no extension block at all, so an empty Extensions pane there is the certificate being old rather than the decoder failing.

Which keys this page claims to read

RSA and ECDSA certificates are the declared scope, both checked against minted fixtures on every test run: RSA prints its modulus size and exponent, elliptic-curve keys print the named curve their identifier stands for. A key carrying explicit curve parameters instead of a curve name gets a note saying so rather than a blank field, since RFC 5480 §2.1.1 requires the named form for PKIX. An Ed25519 public key is recognised by its identifier, but no Ed25519 certificate is claimed until one exists as a checked-in vector.

The cap, the clock and what a link carries

One certificate at a time, up to 65536 bytes — the refusal names that limit, and a 4096-bit certificate is around 2 KB, so the cap is aimed at pasted archives rather than real files. The verdict comes from a clock handed to the decoder: your device's clock in the tool, a fixed instant in the examples above. A shared link encodes four view settings, and the state it serialises has no field a certificate could occupy.

Common errors

This text is not PEM, hex or Base64, so there are no bytes to walk. Paste a -----BEGIN block, an unbroken run of hex digits, or a Base64 body — or drop the file itself, which needs no conversion.: Raised before certificate parsing starts: prose, JSON or a half-copied line has no bytes behind it. Dropping the file is the shortest fix, since that skips the text step entirely.
This is a -----BEGIN CERTIFICATE REQUEST----- block, not a certificate. A certificate block is labelled CERTIFICATE. A certificate signing request is decoded by the CSR decoder.: The label between the dashes is the format, and a request has no issuer, no validity and no signature from anyone but the requester. The message names the label it found, so a mislabelled export shows up at once.
This is a -----BEGIN PRIVATE KEY----- block: private key material, not a certificate. Nothing was sent anywhere, and nothing was stored — paste the certificate instead.: The stop that matters. Private material is refused rather than parsed, and the refusal states what did not happen to it. Files beginning with that fence are the private half of the pair, not the certificate a server presents.
This certificate is incomplete: The SEQUENCE at byte 0 declares 497 content bytes, but only 36 bytes remain in the input. Nothing further could be read at this level. The blob is cut short — decode the complete file, or check that the copy captured every byte. Copy the whole block, including the -----END CERTIFICATE----- line.: The length in the header disagrees with how many bytes arrived, so the counts in the message measure what was lost. Nearly always a selection that stopped early.
This input is 70000 characters, over the 65536-byte (64 KB) limit for one certificate. Paste a single certificate block — a 4096-bit certificate is about 2 KB.: The cap is per decode and is stated in the refusal itself. A paste this large is usually a whole bundle file; one block at a time is faster and clearer.

FAQ

Does the certificate I paste leave this device?

No. Decoding is done by this page's own code, and the tool makes no network request of any kind: its engine and island files contain no fetch, XMLHttpRequest, sendBeacon, EventSource or WebSocket call, which the test suite proves by grep on every run. Nothing you paste is written to this device either.

Does this tell me whether the certificate is trusted?

No, and that is a deliberate boundary. The signature is not verified, no chain is built to a root store, and no revocation check is made, so a healthy-looking readout here says only that the bytes parse and the dates cover today. Trust is decided by the client that will use the certificate, against its own root store.

Why is there no box for a hostname or URL?

Because fetching a live certificate needs a TLS handshake, and a browser page cannot perform one against an arbitrary host — the certificate a page sees is not exposed to its own JavaScript. A field that could only ever fail is worse than no field, so there is none.

Which fingerprint should I compare?

SHA-256, unless something on the other end can only show you SHA-1. Both are computed over the whole DER certificate, not over the public key, which is why the fingerprint changes when a certificate is reissued with the same key. The older digest is printed too, for device consoles that show nothing else.

Why does the common name not decide which hostnames are covered?

Because clients stopped consulting it. RFC 9525 requires the subjectAltName extension for service identity and removed the common-name fallback that RFC 6125 had already deprecated, so a name present only in the subject covers nothing. The alternative names are printed in DER order, with wildcards, punycode labels and IP entries shown as they were encoded.

What happens to an extension you do not recognise?

It stays in the table with its object identifier, its critical marker and its raw bytes, and its DER subtree can be opened or copied as hex. Guessing at a private extension's contents would be worse than showing them, and a critical one nobody can interpret is precisely the case that requires a refusal downstream.

Can it read a signing request or a private key?

Neither. A signing request is a different structure — what an applicant asks for, before an issuer has agreed to any of it — and it has its own decoder. Private key material is refused rather than parsed, alone or attached below a certificate.

Keyboard shortcuts

⌘/Ctrl + Enter: Decode the current text again, on a page that already decodes as you type.
⌘/Ctrl + S: Download the view settings as one .json file — on this page it downloads rather than saving the page, as the help overlay warns.
⌘/Ctrl + C: Copy the selected fingerprint while focus is in the tool and nothing is selected; a real selection copies itself.
⌘/Ctrl + Shift + C: Copy the selected fingerprint — SHA-256 or SHA-1, whichever radio is on — even with a selection on the page.
v: Cycle the view: Fields, then Extensions, then Raw. Obeys the single-key kill switch.
t: Move to the next colour theme, single-key rules again.
? or ⌘/Ctrl + /: Open the shortcut help overlay.
Esc: Close the help overlay; it is the native dialog close, and the pasted text is never cleared.

Nothing you paste here leaves this tab. State only ever travels in links you explicitly create.

RFC 5280 §4.1 — Certificate and CRL Profile: basic fields · RFC 5280 §4.1.2.5 — Validity, UTCTime and GeneralizedTime · RFC 5280 §4.2 — Certificate extensions and criticality · RFC 7468 — Textual Encodings of PKIX Structures (PEM) · RFC 5480 — Elliptic Curve Subject Public Key Information · RFC 6125 — Service Identity in PKIX (deprecating CN) · RFC 9525 — Service Identity in TLS, obsoleting RFC 6125 · RFC 4648 §5 — base64url, used by the shareable link · ITU-T X.680 — ASN.1 basic notation · ITU-T X.690 — BER, CER and DER encoding rules

Last reviewed: 2026-08-18