Certificate decoder

The certificate decoder shows what is inside an X.509 certificate. Paste one or more PEM certificates, or choose a .crt, .cer, .der or .p7b file, and the decoder lists every field. Decoding runs in your browser with JavaScript and WebCrypto; nothing is sent to a server.

How to use it

1. Paste a certificate starting with -----BEGIN CERTIFICATE-----, or a whole chain, or choose a file.
2. The result appears automatically when the PEM is complete (or press Decode).
3. Expand Show PEM on any certificate to copy or download it separately.

Fields explained

• Subject / Issuer: who the certificate is for and which CA signed it.
• SANs: the host names and IPs the certificate is valid for. Browsers check only these, not the CN.
• Valid from / until: the validity period; the badge shows days left.
• Public key: RSA with its size, or ECDSA with its curve.
• Key usage / EKU: what the key may be used for; TLS server certificates need serverAuth.
• Policies: the CA/B Forum OID tells you whether it is DV, OV or EV.
• OCSP / CA Issuers / CRL: where clients check revocation and download the issuer certificate. Since 2025 Let's Encrypt certificates have a CRL URL and no OCSP URL.
• Embedded SCTs: proof the certificate was logged in Certificate Transparency, with the log timestamps.
• SHA-256 fingerprint / SPKI pin: identifiers of the certificate and of its public key. The SPKI hash stays the same when you renew with the same key.

Checking a chain

Paste the leaf first and the intermediates after it. For each certificate the decoder checks that the issuer name matches the next certificate and verifies the signature with the next certificate's public key. A warning means the chain is out of order or incomplete; get a correct one from the chain builder.

To inspect a CSR instead, use the CSR decoder; to change formats, the SSL converter.