SSL Certificate Decoder

Decode an SSL Certificate or CSR in Your Browser

Paste a PEM-encoded X.509 certificate or a PKCS#10 certificate signing request and this tool breaks it into every field that matters: subject and issuer, the validity window with a live "days remaining" countdown, serial number, signature algorithm, public-key type and size, Subject Alternative Names, key usages, basic constraints, key identifiers, and the SHA-1 and SHA-256 fingerprints. Paste a whole chain and each certificate is decoded into its own card.

Unlike the online certificate decoders that upload your PEM to a server, this one parses everything locally with the jsrsasign crypto library — nothing you paste ever leaves your device. That makes it safe for internal, staging, and production certificates, and for the private CSR you are about to hand to a certificate authority.

One honest limit: this is a decoder, not a validator. It reads the fields exactly as they are written in the certificate — it does not verify the signature, walk the trust chain, or check revocation. "Valid" here means the certificate's own not-before and not-after dates cover today, nothing more.

Common uses

• Check an expiry date: Paste a live certificate to see exactly when it expires and how many days remain before you need to renew.
• Confirm the SANs: Verify that every hostname and wildcard you asked for actually made it into the Subject Alternative Name list before you deploy.
• Review a CSR before submitting: Read back the subject, key size, and SANs of a signing request so you never order the wrong certificate from your CA.
• Inspect a chain: Paste the server and intermediate certificates together and read each one's issuer and subject to see how the chain links up.
• Match a fingerprint: Copy the SHA-256 thumbprint to compare against what a browser, a pinning config, or a colleague reports.
• Learn what's inside PKI: See how key usage, extended key usage, and basic constraints are actually encoded while you are studying certificates.

Privacy: This tool runs entirely in your browser. Your certificate, CSR, and the keys they reference are parsed on your own device and are never uploaded, stored, or logged.