X.509 Certificate Decoder
A tool that parses X.509 certificates in PEM or DER format and shows the issuer, subject, expiry date, Subject Alternative Names (SANs), SHA-256/SHA-1 fingerprints, public key type, and more. It flags expired or soon-to-expire certificates and supports certificate chains. Everything runs in your browser.
Paste a PEM certificate or load a certificate file to see its details here.
How to use
- Paste a PEM certificate starting with "-----BEGIN CERTIFICATE-----", or load a .pem / .crt / .cer / .der file.
- The certificate details are listed. The badge at the top shows whether it's valid, expiring soon (within 30 days), expired, or not yet valid.
- Check the Subject Alternative Names (SANs) to see which domain names and IP addresses the certificate covers. Copy fingerprints with the copy buttons.
- Paste a whole certificate chain (e.g. a server certificate plus intermediates) to see each certificate in order.
About this tool
An X.509 certificate is a digital certificate that proves the identity of the other party in HTTPS (TLS) connections and elsewhere. It records, in a format called ASN.1, who it was issued to (subject), who issued it (issuer), how long it's valid (validity period), and which domain names it covers (Subject Alternative Names).
This tool parses the certificate's binary (DER) directly and shows it in a human-readable form. It's useful for checking a certificate before installing it on a server, investigating outages caused by expiry, and verifying the order of a chain and its intermediate certificates. Fingerprints (SHA-256, SHA-1) are hashes of the entire certificate used to identify it uniquely.
Certificates are public information, but internal ones can include hostnames or organization names you'd rather not share. Here, both parsing and hashing happen entirely in your browser, and certificates are never sent to a server. Note that the tool does not verify signatures (i.e. whether a trusted certificate authority issued the certificate).
Frequently asked questions
Can it check whether a certificate is trusted?
No. This tool only displays certificate contents and checks the validity period. It does not verify signatures or check revocation status (CRL/OCSP).
When is "Expiring soon" shown?
It's shown when 30 days or fewer remain until expiry. The check uses your device's current time.
Can it parse private keys or CSRs?
Only certificates (CERTIFICATE) are supported. Private keys should never need to be shared, so we recommend not pasting them into online tools.
Are certificates sent to a server?
No. Parsing and fingerprint calculation both happen in your browser.