Skip to main content

Certificate Decoder: Inspect X.509 Certificates Locally

Parse PEM certificates and certificate chains in your browser: inspect subject, issuer, validity, public key and fingerprints, and verify signatures against a pasted trust anchor. Certificates never leave your device.

Paste a PEM or DER certificate, or a full chain, to read subject, issuer, validity window, SAN entries, serial number and fingerprints. The tool also verifies issuer links and X.509 signatures against an optional trust anchor; hostname, revocation and policy checks stay out of scope.

Tool workspace

Paste the root or an explicitly trusted issuing certificate. It is matched by DER fingerprint or by verifying the last certificate's signature. Nothing is uploaded.

Parsing runs entirely in your browser with no network request. Paste any public certificate — nothing is uploaded.

Scope: parsing and signature checks run locally. The tool verifies issuer links and X.509 signatures against a certificate you paste as a trust anchor. It does not check hostnames, expiry policy, revocation (CRL/OCSP), path-length constraints, or your OS trust store.

No result yet

Enter your input above and the result will appear here.

How to Decode a Certificate Online

Paste a PEM certificate and inspect its fields and fingerprints locally without uploading.

  1. 1

    Paste the certificate

    Copy the PEM block including the BEGIN/END lines into the input box.

  2. 2

    Parse it

    Click Parse Certificate. Every certificate in the chain is decoded and issuer links plus signatures are checked locally.

  3. 3

    Check fingerprints and extensions

    Compare SHA-256/SHA-1 fingerprints and review SAN and key usage extensions.

Common Use Cases
  • 1Verify what a certificate actually claims before trusting a server or file
  • 2Inspect validity dates when debugging expired or not-yet-valid TLS connections
  • 3Compare SHA-256 fingerprints with published values from a vendor or service
  • 4Check SAN entries to confirm a certificate covers the exact domain in use
Security Tips
  • Fingerprints identify a certificate, not its trustworthiness — anchor the chain to a certificate you actually trust
  • Always check Not Before and Not After: many TLS failures come from expired or future-dated certs
  • A self-signed certificate produces a valid parse but no trust path; treat it accordingly
  • Paste certificates only into local tools; a public certificate is not secret, but a private key in the wrong field can be

Frequently Asked Questions

Is the certificate uploaded anywhere?

No. Parsing happens locally in your browser with the Web Crypto API. You can confirm by opening DevTools → Network and watching for requests while pasting.

What formats are supported?

PEM (BEGIN CERTIFICATE blocks) and base64-encoded DER both work. For a chain, paste every block leaf-first, then each issuer up to the root.

What do the fingerprints mean?

SHA-256 and SHA-1 fingerprints are hashes of the certificate's DER bytes. Compare them with the fingerprint published by the issuer or service to catch mismatches.

Does the tool verify the certificate chain?

Yes, structurally: it links each certificate to the next issuer, verifies the signature with that issuer's public key, and can anchor the chain to a certificate you paste. It does not consult your OS trust store, check hostnames, revocation, expiry policy, or path-length constraints.

Can I supply my own trust anchor?

Yes. Paste the root or an explicitly trusted issuing certificate into the optional trust anchor field. It matches by identical DER fingerprint or by successfully verifying the last certificate’s signature.

Related Guides

Related Tools

Network-verified: see this tool's measured requests
Your inputs remain on your device.

You are responsible for key management and output validation.