SSL Certificate Decoder
Read an X.509 certificate or CSR: subject, issuer, dates, domains and fingerprints.
Paste a PEM certificate — or a whole chain, or a certificate signing request — and see what it says: who it was issued to and by, when it expires, which domains it covers, its key, signature algorithm, extensions and fingerprints. DER files (.der, .cer) work too. The certificate is decoded in your browser and never uploaded; it's free and needs no sign-up.
How to decode an SSL certificate
- Paste the PEM text (-----BEGIN CERTIFICATE-----), or drop a .pem, .crt, .cer, .der or .csr file. Try an example shows a sample chain.
- Read each certificate's card: expiry, domains, issuer and key. In a chain, each card says whether the next certificate issued it.
- Copy any value — a fingerprint, the serial number, the list of domains — with its Copy button, or download a certificate as .pem.
Features
- Certificates, whole chains, CSRs and the full output of openssl s_client -showcerts
- PEM, DER files (.der, .cer) or DER as Base64 or hex; up to 50 certificates at once
- Expiry in UTC with the time left, subject, issuer, domains (SAN), key type and size, signature algorithm and serial number
- Extensions: basic constraints, key usage, extended key usage, policies (DV, OV, EV), key IDs, CRL, OCSP and CA issuer URLs
- SHA-256 and SHA-1 fingerprints and the public key pin (SHA-256, Base64)
- Chain check: whether each certificate was issued by the next one in the list
- Copy any value; download each certificate as .pem
Is it private?
Yes. The certificate is decoded by WebAssembly in your browser and never uploaded. Certificates are public anyway, but don't paste private keys: the decoder refuses them and says so.
Frequently asked questions
How do I check when an SSL certificate expires?
Paste it here: its card shows the “Valid until” date in UTC and how long is left, or how long ago it expired. To get a site's certificates, run openssl s_client -connect example.com:443 -showcerts </dev/null and paste the whole output — the certificates are picked out of it.
Do the fingerprints match what OpenSSL and browsers show?
Yes. The SHA-256 and SHA-1 fingerprints are taken over the whole certificate (DER) and written as uppercase hex pairs with colons, the same value openssl x509 -noout -fingerprint -sha256 prints and a browser's certificate viewer shows.
Does it check that the certificate is trusted?
No. It reads what the certificate says. In a chain it checks that each certificate names the next one as its issuer and that their key identifiers agree, but it doesn't verify signatures, revocation or whether a browser trusts the root.
Can it read a certificate signing request (CSR)?
Yes. A CSR (-----BEGIN CERTIFICATE REQUEST-----) shows its subject, the domains it asks for (SAN), key usages, the public key and the signature algorithm.
How do I convert a DER certificate to PEM?
Drop the .der or .cer file here: it is shown as PEM text, and Download .pem saves each certificate as a PEM file. With OpenSSL, the same is openssl x509 -inform der -in cert.der -out cert.pem.