Certificate Decoder

What is Certificate Decoder?

Certificate Decoder is a free online X.509 certificate and CSR inspector. Paste PEM text — a single certificate, a CSR, or a whole bundle with mixed blocks — and every certificate is broken down into subject and issuer names, serial number, validity window, signature algorithm, public key details, SHA-256/SHA-1 fingerprints and the full extension list in as-encoded order: SANs as typed entries (DNS, email, URI, IPv4, IPv6), key usage, extended key usage, basic constraints, key identifiers, CRL distribution points and AIA. Binary DER files work too, via upload or bare-base64 paste.

Features

  • Bundles and chains — paste a fullchain.pem with several certificates: duplicates are detected, the issuer graph is built by name and key-identifier matching (cross-signed ambiguity is surfaced, never silently picked), and every link's signature is verified cryptographically with an explicit per-link status
  • Honest verification copy — links read "signature verifies", never "trusted": there is no root store and revocation is not checked, and the tool says so
  • CSR inspection — subject, public key, requested extensions from the extensionRequest attribute, and a self-signature check so you can validate a CSR before submitting it to a CA
  • Real-world DN handling — subject and issuer are shown as ordered RDN lists (repeated OUs, DC components, emailAddress and unknown OIDs included) plus an RFC 4514 rendering; signed serial numbers, RSA-PSS parameters and v1 certificates without extensions are all handled correctly
  • Private keys are never read — PRIVATE KEY blocks are detected, skipped with a warning, and their material is never parsed, displayed or echoed

How to use

Paste PEM text into the input, drop a .pem/.crt/.cer/.csr/.der file, or click Upload. Each block renders as its own card in input order; when two or more unique certificates are present, a chain section appears above them showing the leaf-first ordering and per-link signature status. Fingerprints, serials and SPKI pins have copy buttons, and every certificate can be downloaded back as PEM or DER.

Privacy

Parsing and signature verification run locally in the browser UI. Certificates you inspect on the page are not uploaded or logged.

Read the full Certificate Decoder guide and the Certificate Decoder API reference.