PEM Certificate Decoder
Paste an X.509 certificate or CSR and read its subject, issuer, dates, public key and SANs in seconds. Every byte is parsed inside this page.
Clear validity. Full SAN list. SHA-256 and SHA-1 fingerprints.
Decode a certificate
Paste, drop, or load a sample. Parsing happens immediately.
Waiting for PEM text.
How it works
Three steps, no server round trip.
Paste or drop
Use the PEM armour from a .crt, .cer, .pem or .csr file. Multiple blocks are detected, and the first certificate or CSR is decoded.
Parse in the browser
A small ASN.1 reader extracts the certificate fields and the subjectAltName extension. There is no upload endpoint and no third-party API.
Read and copy
Check the validity window, SANs and fingerprints. Each field has a copy button so you can hand the exact value to a teammate or ticket.
Questions, answered
Is my certificate uploaded?
No. The PEM text stays in your browser and is decoded by the page's own JavaScript. The page has no API route for certificate data.
Does “Valid” mean the chain is trusted?
No. It means the current date falls inside the certificate's notBefore/notAfter window. This decoder does not verify signatures, build a chain, or check the browser trust store.
Why is a CSR's validity “not applicable”?
A PKCS#10 CSR is a request for a certificate. It has a subject, public key and optional requested extensions, but no notBefore/notAfter dates until a CA issues the certificate.
Which inputs are supported?
PEM certificate and CSR blocks, plus headerless base64 DER. Binary DER files are not read directly; convert them with openssl x509 -inform DER -in cert.cer -out cert.pem.
Built for incident response, not data collection
No certificate bytes are sent to this site's server, stored, logged, or forwarded to another service. The only network requests are for the page's own CSS, font system and htmx shell.