X.509 Certificate Decoder
Paste a PEM or DER X.509 certificate or CSR and read its subject, issuer, validity dates, subject alternative names, public key, and signature algorithm, entirely in your browser.
X.509 Certificate Decoder — Drop a PEM (-----BEGIN CERTIFICATE-----) or base64 DER blob into the box and instantly see the human-readable fields inside: who the certificate is for, who signed it, when it expires, what hostnames it covers, and which key and signature algorithms it uses. It also understands certificate signing requests (CSRs), so you can sanity-check a request before you hand it to a CA. Everything is parsed locally with pkijs and asn1js loaded on demand, so your certificate and private details never leave the page.
What is X.509 Certificate Decoder?
The X.509 Certificate Decoder is a free, in-browser tool that turns the dense base64 of a TLS/SSL certificate or a PKCS#10 certificate signing request into a clear, readable summary. Sysadmins, DevOps engineers, and security reviewers use it to confirm which domains a certificate protects, check the not-before and not-after dates before a renewal, inspect the issuer and subject, and read the public key size and signature algorithm without reaching for openssl on the command line. It accepts a full PEM block or a raw base64 DER body in the Certificate or CSR input, detects whether the blob is a certificate or a CSR, and lays out the Subject, Issuer, serial number, validity window, Subject Alternative Names, public key, and signature algorithm. Because the parsing runs with pkijs and asn1js entirely inside your browser, nothing is uploaded and the tool keeps working offline.
How to use X.509 Certificate Decoder
- Copy a certificate or CSR, including the -----BEGIN----- and -----END----- lines if you have them, or just the base64 body.
- Paste it into the Certificate or CSR input box; decoding starts automatically as soon as it parses.
- Read the Decoded details output: Subject, Issuer, validity dates, Subject Alternative Names, public key, and signature algorithm.
- Use the copy button to grab the full decoded summary, or copy individual lines from the output.
- If the input is not a valid certificate or CSR, fix the surrounding text or padding shown in the error note and try again.
Examples
Reading a website's leaf certificate
Input
-----BEGIN CERTIFICATE----- MIIDdzCCAl+gAwIBAgIE...truncated... -----END CERTIFICATE-----
Output
Subject: CN=example.com Issuer: CN=R3, O=Let's Encrypt, C=US Valid from: 2026-01-01 Valid to: 2026-04-01 SANs: example.com, www.example.com Public key: RSA 2048-bit Signature: RSASSA-PKCS1-v1_5 with SHA-256
Checking a CSR before submitting it
Input
-----BEGIN CERTIFICATE REQUEST----- MIICijCCAXICAQAw...truncated... -----END CERTIFICATE REQUEST-----
Output
Type: Certificate Signing Request (CSR) Subject: CN=api.example.com, O=Example Inc Public key: EC P-256 Signature: ECDSA with SHA-256
Frequently asked questions
- Is my certificate or CSR uploaded anywhere?
- No. Decoding runs entirely in your browser with the pkijs and asn1js libraries loaded on demand. The certificate or CSR you paste is never sent to or stored on any server, so the tool works offline and your data stays on your device.
- What input formats are accepted?
- PEM blocks wrapped in -----BEGIN CERTIFICATE----- or -----BEGIN CERTIFICATE REQUEST----- lines, and raw base64 DER bodies without the wrapper. The tool strips whitespace and the header/footer automatically, then decodes the base64 to DER bytes.
- Does it tell certificates and CSRs apart?
- Yes. It first tries to parse the input as an X.509 certificate; if that fails it tries a PKCS#10 certificate signing request, and the output labels which one it found. CSRs have no validity dates or issuer, so those fields are omitted for them.
- Why does it say my input is invalid?
- The base64 may be truncated, contain stray characters, or be a different format such as a private key or a PKCS#12 bundle. Make sure you pasted the whole certificate body and that the header and footer lines match the content.
- Can it verify whether the certificate is trusted or expired?
- It shows the not-before and not-after dates so you can judge expiry yourself, but it does not validate the certificate against a trust store or check revocation. It is a read-only decoder, not a chain validator.
Related tools
AES Text Encryption (AES-GCM + PBKDF2)
Encrypt and decrypt text with AES-256-GCM using a passphrase-derived key (PBKDF2 SHA-256, random salt), entirely in your browser with no uploads.
Argon2 & scrypt Hash
Hash a password with Argon2id or scrypt and verify an Argon2 hash against a password, entirely in your browser.
Bcrypt Hash Generator & Verifier
Generate a bcrypt password hash from plain text at a chosen cost factor, or verify a password against an existing bcrypt hash, entirely in your browser.
BIP39 Mnemonic Generator
Generate a random BIP39 recovery phrase of 12 to 24 words in several languages, or convert an existing mnemonic back into its raw entropy, entirely in your browser.