You are responsible for key management and output validation.
Certificate Decoder: Inspect X.509 Certificates Locally
Parse PEM certificates in your browser and inspect subject, issuer, validity, public key, extensions, and SHA-256/SHA-1 fingerprints. Certificates never leave your device.
Parsing runs entirely in your browser with no network request. Paste any public certificate — nothing is uploaded.
How to Decode a Certificate Online
Paste a PEM certificate and inspect its fields and fingerprints locally without uploading.
- 1
Paste the certificate
Copy the PEM block including the BEGIN/END lines into the input box.
- 2
Parse it
Click Parse Certificate. Subject, issuer, validity, and public key are extracted locally.
- 3
Check fingerprints and extensions
Compare SHA-256/SHA-1 fingerprints and review SAN and key usage extensions.
Common Use Cases
- 1Verify what a certificate actually claims before trusting a server or file
- 2Inspect validity dates when debugging expired or not-yet-valid TLS connections
- 3Compare SHA-256 fingerprints with published values from a vendor or service
- 4Check SAN entries to confirm a certificate covers the exact domain in use
Security Tips
- Fingerprints identify a certificate, not its trustworthiness — verify the certificate chain separately
- Always check Not Before and Not After: many TLS failures come from expired or future-dated certs
- A self-signed certificate produces a valid parse but no trust path; treat it accordingly
- Paste certificates only into local tools; a public certificate is not secret, but a private key in the wrong field can be
Frequently Asked Questions
Is the certificate uploaded anywhere?
No. Parsing happens locally in your browser with the Web Crypto API. You can confirm by opening DevTools → Network and watching for requests while pasting.
What formats are supported?
PEM (BEGIN CERTIFICATE blocks) and base64-encoded DER both work. For a certificate chain, paste all blocks and only the first certificate is decoded.
What do the fingerprints mean?
SHA-256 and SHA-1 fingerprints are hashes of the certificate's DER bytes. Compare them with the fingerprint published by the issuer or service to catch mismatches.
Related Guides
Certificate Decoder Guide: Read X.509 Details
Every TLS handshake starts with a certificate. Decode the fields that matter: subject, issuer, validity,…
How to Decrypt AES-256-GCM Locally
Decrypting AES-256-GCM is straightforward when you have the password and the right metadata. Here is the…
AES-256-GCM Encryption: A Developer's Guide
Encrypt and decrypt files locally in your browser with AES-256-GCM - no upload, no account. Code examples,…