Certificate decoder
Decode X.509 certificates and chains, CSRs, public and private keys, PKCS#7 bundles, and any DER as an ASN.1 tree; check chain order and expiry; and fingerprint SSH public keys. Everything stays in the browser.
Added · updated 28 October 2026
Works with
- TLS 1.3 and QUIC handshakes Networkopens the server certificate from its simulated TLS 1.3, TLS 1.2 and QUIC handshakes here to decode
- Packet capture viewer (mini Wireshark) Networkopens a certificate chain from a TLS handshake in a capture here
How to use it
What to paste
-
One or more PEM blocks, such as the output of
openssl s_client -connect example.com:443 -showcerts </dev/null, afullchain.pem, or a.p7bbundle. Base64 or hex DER works too, or open a file. -
A certificate signing request (
BEGIN CERTIFICATE REQUEST). -
Public keys (SPKI or PKCS#1) and private keys (PKCS#1, PKCS#8, or SEC1 EC). Private keys are only parsed locally and are never remembered, even with Remember input on. Use a test key anyway.
-
An SSH public key line (
ssh-ed25519 AAAA… user@host), to get the SHA256 and MD5 fingerprints thatssh-keygen -lfprints.
What it shows
For each certificate:
-
Subject, issuer, and validity, with the days remaining (or how long ago it expired).
-
Subject alternative names, the key type and size or curve, and the signature algorithm.
-
Serial number and version.
-
Key usage and extended key usage, basic constraints, and the subject and authority key identifiers.
-
CRL distribution points, OCSP and CA-issuer URLs (AIA), and policies such as DV, OV, or EV.
-
SHA-256 and SHA-1 fingerprints, which match
openssl x509 -fingerprint.
With more than one certificate, the chain is checked link by link. Each issuer must match the next subject and the key identifiers must agree. If the order is wrong, a leaf-first order is suggested.
Every object also has its full ASN.1 structure: tags, lengths, decoded values, and OIDs named where known. DER nested inside bit and octet strings is unpacked too.
Feedback is a gift. Something to improve, a feature to add, or a bug? Tell me.
Runs entirely in your browser; nothing you type leaves this page.