Hashes/Crypto
X.509 / SSL Certificate Decoder
Decode a PEM certificate (X.509/ASN.1 DER) — subject, issuer, validity, public key, extensions, and fingerprints.
A PEM-format SSL/TLS certificate is essentially a text representation of a binary ASN.1 DER structure, unreadable without decoding. This tool breaks a certificate down into understandable fields: subject, issuer, validity period, public key, and fingerprints.
How to use it
- Paste a certificate in PEM format (starting with -----BEGIN CERTIFICATE-----) and it's parsed instantly.
- The result shows the subject (who it was issued to), the issuer (CA), the validity period, the public key's algorithm and size, extensions (SAN, key usage), and fingerprints (SHA-1, SHA-256).
- The Subject Alternative Names (SAN) list shows every domain the certificate is valid for.
Common uses
- Quickly checking a certificate's expiry date and the domains it covers without reaching for openssl in a terminal.
- Debugging HTTPS issues by checking a certificate's issuer, trust chain, or signature algorithm.
- Comparing a certificate's fingerprint against an expected value to verify authenticity.
Things to keep in mind
Parsing a certificate only shows its content — it doesn't verify the trust chain up to a root CA or check revocation status (CRL/OCSP); those need separate checks.
Modern certificates have short validity periods (90 days for Let's Encrypt) specifically to reduce the risk from a compromised key — that's expected practice, not a sign of a problem.
Article about this tool: X.509: what's inside an SSL certificate
Frequently asked questions
What information does an X.509 certificate actually contain?
It bundles a public key together with identity details (subject, issuer, validity dates) and a digital signature from a certificate authority (or itself, if self-signed), letting others verify who the key belongs to and that it hasn't been tampered with.
What's the difference between the certificate chain and the leaf certificate?
The leaf certificate identifies the actual server or entity, while the chain includes one or more intermediate certificates linking it back to a trusted root CA — a browser needs the full chain to establish trust, not just the leaf.
Does decoding a certificate here upload it anywhere?
No. Parsing and decoding happen entirely in your browser — the certificate content never leaves your device.
When is a self-signed certificate okay to use?
For internal testing, development, or closed networks, where public browser trust isn't needed. For a public-facing site, browsers will flag a self-signed certificate as untrusted, since the chain doesn't lead to any root CA.
Why do certificates have a limited validity period?
A limited validity period (typically 90 days to 1 year for modern certificates) reduces the risk from a compromised private key and forces regular updates of cryptographic parameters in line with current security standards.