X.509 Certificate Decoder
Decode PEM X.509 certificates in your browser — subject, issuer, validity, public key, SANs, key usage, and extensions. Uses a compact DER/ASN.1 parser, nothing is uploaded.
PEM certificate
How it works
- Paste a PEM certificate (the
-----BEGIN CERTIFICATE-----block from a.crt,.pem, or TLS handshake). - The tool base64-decodes the body into DER and walks the ASN.1 structure: version, serial, signature, issuer, validity, subject, public key, and extensions.
- Subject Alternative Names (DNS / IP / email / URI) and key usage flags are decoded from the standard X.509 extension OIDs.
- Everything is parsed on your device — certificates are public by design, but your data still never leaves the browser.
About X.509 Certificate Decoder
X.509 certificates are the public keys of TLS and PKI. A certificate is an ASN.1 DER structure base64-encoded into PEM: who issued it (issuer), who it belongs to (subject), the validity window, the public key and algorithm, and extensions such as Subject Alternative Names (the hostnames the certificate is valid for) and key usage. Reading these fields by hand means decoding DER byte by byte — this tool does that for you so you can quickly answer questions like “when does this cert expire?”, “which domains is it valid for?”, or “is it CA-signed?”.
This decoder is for inspection only — it does not verify the trust chain or the signature (that requires the issuer’s public key and a CA store). For trust validation use a proper TLS stack. Note that certificates are public information; still, this tool runs locally so you can inspect internal-PKI certs, customer certs, or key-material-adjacent data without third-party servers seeing them.