Certificate Decoder
Decode X.509 certificates and chains from PEM or DER
About Certificate Decoder
Decodes PEM or DER X.509 certificates, including full chains, into subject and issuer, serial number, validity with days remaining, key type and size, SHA-1 and SHA-256 fingerprints, and extensions such as SANs, key usage, basic constraints, AIA and CRL points. Parsing is client-side. Signatures, trust and revocation are not checked, so use it to inspect certificates rather than validate them.
Category: Encoding.
Frequently asked questions
Which formats can I paste or load?
▾
PEM text with one or more BEGIN CERTIFICATE blocks, a bare Base64 certificate such as an x5c entry, or a .pem, .crt, .cer or .der file; binary DER is detected by its first byte and shown as PEM. PKCS#7 (.p7b) and PKCS#12 (.pfx) bundles aren't supported.
Does it check whether a certificate is trusted or revoked?
▾
No. It decodes the fields and compares the validity dates with your device's clock, but it doesn't verify signatures, build a path to a trusted root or query OCSP or CRLs. Chain hints such as Issued by certificate 2 only compare issuer and subject names.
Why does it say my input looks like a private key?
▾
Blocks such as BEGIN PRIVATE KEY or BEGIN RSA PRIVATE KEY are refused without decoding, because private keys should never be pasted into websites. If a file mixes certificates and a key, only the certificates are shown, with a warning; a CSR is recognized, but only its subject and key type are reported.
How are the fingerprints calculated?
▾
They are SHA-1 and SHA-256 hashes of the certificate's DER bytes, shown as colon-separated uppercase hex, the same values openssl x509 -fingerprint prints. They identify the certificate rather than the key, so a renewed certificate gets new fingerprints even when it reuses the key.