Certificate decoder: read a PEM certificate or CSR in your browser
Paste a PEM-encoded X.509 certificate or a certificate signing request and see its subject, issuer, validity, public key, extensions and fingerprints. Decoding runs entirely in your browser - the text never leaves the page, no sign-up needed.
What the certificate decoder reads
The subject and issuer, the validity dates, the public key type and size, every subject alternative name, the key usage and extended key usage flags, and the SHA-256 and SHA-1 fingerprints - straight out of the certificate's own DER structure.
Find out moreWhy paste, not upload
A certificate is public by design - your server already hands it to every visitor's browser during the TLS handshake. This tool still never sends what you paste anywhere: decoding runs locally, in JavaScript, with no request leaving the page.
Find out moreA decode tells you today. Monitoring tells you the day it changes
This is a one-time read of the text you pasted. An SSL certificate monitor fetches the certificate your server actually serves on a schedule and warns you 30, 7 and 1 day before it expires.
Find out moreCommon questions
Is it safe to paste a certificate here?
Yes. A certificate is public data - it is exactly what your server already sends to every visitor's browser. Nothing you paste is uploaded or stored; decoding happens locally in your browser. A CSR is also fine to paste, since it carries no private key material. Never paste a PRIVATE KEY block anywhere, including here - the tool detects one and refuses to read it.
What is a CSR, and what does this tool show for one?
A certificate signing request (CSR) is what you generate and send to a certificate authority when requesting a certificate - it carries the subject, the public key and, usually, the domain names it is being requested for. For a CSR this tool shows the subject, the public key type and size, the signature algorithm, and the requested subject alternative names read from its extensionRequest attribute.
Why does it say "Unknown extension"?
Certificates can carry extensions beyond the common set this tool decodes in full - Certificate Transparency SCTs and certificate policy statements are two examples that show up often. An extension the tool does not decode is still listed, by its object identifier, rather than hidden.
Can I decode a whole certificate chain at once?
Yes. Paste several PEM blocks one after another - a leaf certificate followed by its intermediates, for example - and each one is decoded on its own and shown in the order it appears.
Why do the fingerprints matter?
The SHA-256 and SHA-1 fingerprints are hashes of the certificate's raw DER bytes - a short, unique way to confirm two copies of "the same" certificate are actually identical, or to compare against a fingerprint published or pinned elsewhere.
Does this replace checking what my server actually serves?
No. This tool reads the file you paste, not what your server hands to a real connection. To check the certificate a server is actually presenting right now, use the SSL certificate checker instead (linked below).
This decodes the certificate or CSR text you paste. To check the certificate a server actually presents on a real connection, from 300+ locations, use the SSL certificate checker. For expiry alerts before a live certificate lapses, see SSL certificate monitoring.
Key takeaways
- This tool decodes a pasted PEM certificate or CSR entirely in your browser, using a built-in DER parser; the text is never uploaded or sent to a server.
- For a certificate it shows the subject, issuer, validity dates, serial number, signature algorithm, public key type and size, subject alternative names, key usage and extended key usage, and SHA-256 and SHA-1 fingerprints.
- It also reads certificate signing requests (CSRs), showing the requested subject, public key and subject alternative names, and it decodes multiple concatenated PEM blocks as a chain, in order.
- It is free, needs no login and no credit card.
- For the certificate a server is actually presenting, see the SSL certificate checker, and for expiry alerts before a live certificate lapses, see SSL certificate monitoring.
Part of HostTracker's website monitoring software.