X.509 Certificate & CSR Decoder

Decode and verify SSL/TLS X.509 certificates and CSRs in your browser. Inspect SANs, validity, issuer, and fingerprints without exposing sensitive internal certs to external servers.

Private by architecture: All processing is 100% client-side memory. Your data never leaves this browser tab.

PEM Encoded Certificate or CSR

0 charsX.509 PEM

Paste a PEM certificate or drop a .crt file to inspect details.

About This Tool

Parses PEM-encoded X.509 certificates and CSRs with a zero-dependency ASN.1/DER parser, surfacing Subject, Issuer, validity window, SANs, fingerprints, and key/signature algorithm without requiring openssl commands. Inspect certificates safely for expiration dates, root CA issuers, and requested domain names.

This is a read-only inspector rather than a chain validator: it does not verify certificates against a live CA trust store or query OCSP/CRL revocation endpoints, keeping your inspection strictly offline and private.

Key Features

Certificate & CSR Support: Parses both full X.509 certificates and PEM-formatted certificate signing requests.
Active / Expired Status Badge: Evaluates Not After expiration dates against browser local time, displaying remaining validity days.
Cryptographic Fingerprints: Computes SHA-256 and SHA-1 hashes across raw DER payload bytes using the Web Crypto API.
Algorithm Detection: Identifies RSA and Elliptic Curve (ECDSA) public keys and signature algorithms.
SANs Breakdown: Renders Subject Alternative Names cleanly as scannable tags.
Local File Upload: Drag and drop or upload .crt, .pem, .cer, or .csr files without uploading data to servers.

Frequently Asked Questions

Does this decode CSRs as well as certificates?

Yes. Paste a -----BEGIN CERTIFICATE REQUEST----- block and it parses the Subject and public key info the same way; fields specific to issued certificates, like Validity and Issuer, only appear for full certificates.

What file types can I upload?

.pem, .crt, .cer, .csr, and plain .txt files containing PEM text are accepted via the upload button or by pasting directly into the editor.

How is the Active / Expired badge determined?

It compares the certificate's Not After date to the current time in your browser. Green means still within the validity window; red means the certificate has expired.

Are the fingerprints computed correctly for any key type?

SHA-256 and SHA-1 fingerprints are computed over the full DER-encoded certificate bytes using the browser Web Crypto API, independent of the key algorithm (RSA, etc.) used inside the certificate.

Is the certificate uploaded or sent anywhere?

No. Parsing is done with a zero-dependency ASN.1/DER parser that runs entirely in your browser. This makes it safe to inspect internal or private certificates without exposing them to a third-party server.