SSL Certificate and CSR Decoder
Free SSL certificate decoder and CSR decoder: paste a PEM or DER file to see subject, issuer, expiry, SANs, key type, extensions and SHA-256 fingerprints.
How to use Certificate Decoder
- 1Paste a PEM certificate or CSR (or several for a chain), or open a certificate file.
- 2Read the subject, issuer, validity, key, SANs and extensions for each certificate.
- 3Copy a fingerprint, or press Copy as JSON to keep the decoded details.
What makes it better
- Reads certificates and CSRs in PEM, Base64 or DER, including chains
- Shows subject and issuer, expiry with days left, RSA, EC or Ed25519 keys and signature algorithm
- Lists SANs, basic constraints, key usage, extended key usage, policies, CRL and OCSP links
- SHA-1 and SHA-256 fingerprints in the usual colon-separated form
- Unknown extensions listed by OID with a hex dump; hostile input is size and depth limited
About Certificate Decoder
Certificate Decoder reads X.509 certificates and PKCS#10 certificate signing requests and shows what is inside in plain language: subject and issuer, validity with days left, public key, signature algorithm, Subject Alternative Names, key usage, policies, links and fingerprints. You can paste PEM, Base64 or open a .pem, .crt, .cer, .csr or .der file, and several certificates are treated as a chain. Decoding is done on your device by a small ASN.1 reader.
Common uses
- Check when a certificate expires and which host names it covers before it breaks a site.
- Confirm that a CSR contains the right common name, SANs and key size before sending it to a CA.
- Inspect a downloaded chain to see which certificate is the leaf, the intermediate and the root.
- Compare a certificate's fingerprint with one a provider gave you for pinning.
Example
Input
-----BEGIN CERTIFICATE----- MIIBVTCCAQegAwIBAgIUGt+Ix2Thkd7f8pI+gff5LNy/oOowBQYDK2VwMBkxFzAV BgNVBAMMDmVkLmV4YW1wbGUubmV0MB4XDTI2MTExMDE4MjgxOFoXDTM2MTEwNzE4 MjgxOFowGTEXMBUGA1UEAwwOZWQuZXhhbXBsZS5uZXQwKjAFBgMrZXADIQD1HNOe b1PUB+BoLFpwakeMHu4hlWZCtyxew45gYnM/3aNhMF8wHQYDVR0OBBYEFCCAYP31 Bq0Db2oxpXgrCeoXCDTwMA8GA1UdEwEB/wQFMAMBAf8wLQYDVR0RBCYwJIIOZWQu ZXhhbXBsZS5uZXSCEnd3dy5lZC5leGFtcGxlLm5ldDAFBgMrZXADQQDu36MZHuO2 I3Ag8zmkqbXrp3yfY41euL5BnLunH7Pwu1CuSBZ9ocauo6veXts1C6sq9ycCdHor dVpKnUeAf8cB -----END CERTIFICATE-----
Result
CN=ed.example.net · issued by CN=ed.example.net · valid 2026-11-10 to 2036-11-07
Good to know
- This page only describes what is in the file. It does not check signatures, revocation or trust, so a certificate shown here is not proof that it is genuine or that a browser would accept it.
- The chain check is structural: it compares each certificate's issuer name with the next certificate's subject and key identifiers, nothing more.
- Never paste a private key. If you do, the page refuses it, but treat that key as exposed and replace it.
Certificate Decoder FAQ
How do I decode a CSR to check its contents?
Paste the block that starts with BEGIN CERTIFICATE REQUEST. The page shows the subject, the public key and its size, the signature algorithm and the extensions the request asks for, such as Subject Alternative Names.
What is the difference between PEM and DER?
DER is the binary encoding of a certificate. PEM is the same bytes written as Base64 between BEGIN and END lines so it can be pasted in text. Files ending in .pem, .crt or .cer may hold either; this tool accepts both.
How do I see the SANs of a certificate?
Subject Alternative Names appear in their own list with the type of each entry: DNS names, IP addresses, email addresses and URIs. Browsers match a site name against these entries rather than the common name.
What does self-signed mean here?
The page marks a certificate as self-signed when its issuer and subject are identical and its key identifiers agree. It does not verify the signature, so treat the label as a description of the names, not as a cryptographic result.
How are the SHA-256 fingerprints calculated?
They are the SHA-256 and SHA-1 hashes of the certificate's complete DER bytes, written in upper-case hex with colons. These are the values browsers and tools such as openssl show, so they can be compared directly.