About this tool
The X.509 Certificate Decoder parses a TLS/SSL certificate and shows its contents in plain language. Paste a PEM block (the -----BEGIN CERTIFICATE----- armor) or base64/hex DER, and the tool strips the armor, base64-decodes to raw DER bytes, and walks the ASN.1 structure with a hand-written tag-length-value parser — no external library. It reads the TBSCertificate SEQUENCE to extract the version, serial number, signature algorithm (OID mapped to a name), the issuer and subject distinguished names (CN, O, OU, C, ST, L, emailAddress), and the notBefore / notAfter validity window from their UTCTime or GeneralizedTime fields.
All parsing happens locally in your browser and nothing is uploaded, so you can inspect private or internal certificates safely. From the subjectPublicKeyInfo the decoder reports the key algorithm and size — for RSA it measures the modulus bit length, for EC it names the curve. It decodes the common extensions too: Subject Alternative Name (DNS, IP, email, URI entries), Key Usage bits, and Basic Constraints (the CA flag). It also computes how many days remain until expiry and flags certificates that are expired or expiring within 30 days.
SHA-1 and SHA-256 fingerprints are computed with the browser's WebCrypto API over the exact DER bytes, matching the values openssl x509 -fingerprint prints. This tool decodes certificates specifically; for JSON Web Tokens use the dedicated JWT decoder instead. Copy the full decoded report with one click.