Cryptography

PEM / X.509 Certificate Decoder

Inspect certificate identities, validity, SANs, algorithms, and fingerprints locally.

Fields extracted from an X.509 certificate

The decoder reads ASN.1 DER carried directly as Base64 or inside RFC 7468 PEM boundaries. It reports distinguished subject and issuer names, serial number, not-before and not-after dates, signature and public-key algorithms, supported subject alternative names, extension OIDs, byte size, and a SHA-256 digest of the exact certificate bytes.

Loading tool...

Validity and self-signature are narrow checks

  • Currently valid means the browser clock is between notBefore and notAfter; it does not establish trust or intended usage.
  • Self-issued means subject and issuer names match, while cryptographically self-signed additionally requires the signature to verify with the certificate public key.
  • Unsupported browser cryptography can leave the self-signature result unknown even when the certificate structure decodes.
  • A SHA-256 fingerprint identifies exact DER bytes for comparison; it becomes a trust signal only when obtained from an independent trusted channel.

Checks that still belong to a TLS or PKI validator

This page does not build a chain against operating-system or browser roots, retrieve intermediates, check key usage or policy for a specific purpose, match a hostname, query OCSP or CRLs, inspect Certificate Transparency logs, or connect to a server. Those decisions require the trust store, connection context, and validation policy of the real client.

Related developer tools

Continue with JWT Decoder, Signer & Verifier, SHA256 Hash, HMAC Generator & Verifier.

JWT Decoder, Signer & Verifier

Decode JWTs and sign or verify HS256, HS384, and HS512 tokens locally

SHA256 Hash

Generate SHA256 hashes

HMAC Generator & Verifier

Generate and verify keyed SHA message authentication codes

How to Use PEM / X.509 Certificate Decoder

  1. Paste one PEM certificate, a PEM chain, or Base64-encoded DER.
  2. Decode and review the validity badge, identity fields, algorithms, and SHA-256 fingerprint.
  3. Inspect SAN entries and extension OIDs for the names and capabilities you expect.
  4. Use a real TLS or PKI validator with the correct trust store before making a security decision.

Frequently Asked Questions

Does decoding prove that a certificate is trusted?

No. Parsing shows encoded fields and can test whether a certificate verifies with its own public key. Trust also requires a valid chain to an accepted root, purpose and name checks, policy, time, and often revocation or transparency evidence.

Can I paste a complete PEM certificate chain?

Yes. The tool extracts and decodes up to ten CERTIFICATE blocks in input order. It does not reorder them or prove that each certificate signed the next one.

Are private keys accepted?

No. The input accepts PEM CERTIFICATE blocks or Base64-encoded DER certificates. Private-key and certificate-request text is rejected; do not paste private keys into browser tools.

Sources & references

Primary references: RFC 5280: Internet X.509 Public Key Infrastructure Certificate Profile; RFC 7468: Textual Encodings of PKIX Structures; W3C Web Cryptography API.

Review policy: references and behavior notes are checked whenever the tool implementation changes.