Decode an SSL Certificate or CSR
Decode X.509, PEM and CSR files
A web page cannot inspect a remote server's TLS certificate. There is no JavaScript API for it; exposing one was proposed to the W3C in 2013 and never shipped, which is why every online SSL checker runs on a server. What a browser can do perfectly well is decode a certificate you already hold, and that is what this does. It matters because the usual alternative is pasting a certificate signing request, which describes a key you are about to have signed, into somebody else's website. Nothing here is uploaded.
What is Certificate Decoder?
Decode an X.509 certificate, a certificate chain or a CSR and read what is actually inside it: subject, issuer, validity dates, alternative names, key algorithm and size, key usage, extensions and fingerprints. Paste PEM text or drop a .crt, .cer, .der or .csr file. Everything is parsed in your browser, which matters here: the usual way to read a certificate signing request is to paste it into a stranger's website, and a CSR describes a key you are about to have signed. This tool also flags a certificate that is weak by modern standards, such as a SHA-1 signature or an RSA key under 2048 bits.
How do I use Certificate Decoder?
- Paste the PEM text, including the BEGIN and END lines, or drop the file.
- Read the decoded fields; a chain is decoded certificate by certificate.
- Check the expiry banner, which counts the days remaining.
- Copy any field, including the SHA-256 fingerprint.
When should I use Certificate Decoder?
Use this to confirm what a certificate covers before installing it, to check a CSR before sending it to a CA, or to read an expiry date without trusting a website with the file. To decode a JWT instead, use JWT Decoder. To hash a downloaded file for comparison, use Hash Generator.
Frequently asked questions
Can this check a live website's certificate?
No, and no web page can. There is no JavaScript API that exposes a TLS peer certificate; exposing one was proposed to the W3C in 2013 and never shipped. That is why every online SSL checker runs on a server. What a browser can do is decode a certificate you already have, which is what this does.
Is my certificate uploaded?
No. It is parsed by a decoder running in this tab. That matters most for a CSR: a certificate signing request describes a key you are about to have signed by a certificate authority, and pasting one into an unknown website is a habit worth breaking.
Can I paste a private key?
The tool refuses one and tells you why. Nothing here is uploaded, but there is no good reason to paste a private key into any website, including this one, and a tool that quietly accepted it would be teaching a bad habit.
What formats does it read?
PEM text for certificates, chains and CSRs, and raw DER files such as .cer and .der. Paste a full chain and every certificate in it is decoded in turn.
Why are two fingerprints shown?
Because different systems display different ones. SHA-256 is the modern default and what you should compare against. SHA-1 is still shown by some consoles and pinning configurations, so it is there for matching rather than as a recommendation.
What does the weak-certificate warning mean?
It appears for a SHA-1 signature or an RSA key under 2048 bits. Browsers stopped accepting SHA-1 for public certificates in 2017, and public CAs will not issue RSA below 2048 bits. Neither is necessarily a problem for an internal or test certificate, which is why it is a note rather than an error.
The dates look wrong by a century.
That is a classic bug in certificate decoders, not something you should see here. X.509 encodes years as two digits in UTCTime, and RFC 5280 says 50 to 99 mean 1950 to 1999 while 00 to 49 mean 2000 to 2049. This tool applies that rule and has tests covering the boundary.
Is my file uploaded anywhere?
No. Everything runs in your browser. Your files never leave your device, and there is no server component for this tool.
Tools that pair well with Certificate Decoder
- JWT Decoder inspect jwt payloads, free and in your browser.
- Hash Generator md5, sha-256, sha-512, free and in your browser.
- Base64 Decoder decode base64 strings, free and in your browser.
- HMAC Generator hmac with any hash, free and in your browser.