X.509 Certificate Decoder
Inspect a public certificate or full chain without uploading it. Decode identity, validity, hostnames, keys, fingerprints, extensions, and byte-level ASN.1 evidence directly in this browser.
- PEM, Base64, hex, and binary DER
- Whole-chain navigation
- Local processing only
- No trust claims without verification
Certificate input
BEGIN CERTIFICATE blocks. Press Ctrl/Command + Enter to decode. Private keys and CSRs are rejected.
Drop up to 16 certificate files here. Total input is limited to 2 MiB to keep parsing responsive.
Private by design: parsing and fingerprints stay in this tab. The decoder makes no network request.
Decoded certificate
Identity and validity
Names, key, and signatures
Presented chain evidence
Issuer-name and key-identifier relationships are structural clues only. They are not cryptographic signature or trust validation.
Extensions
Fingerprints and raw evidence
ASN.1 structure with byte offsets
Original certificate as PEM
How to read the result
Start with SAN, not Common Name
Modern TLS clients use Subject Alternative Names for hostname coverage. The optional hostname test follows exact-name and one-label wildcard rules.
Validity is only one check
A current date window does not establish trust. A client must also build a trusted chain, verify signatures, and consider revocation and policy.
Compare SHA-256 fingerprints
Matching full-certificate fingerprints prove two files contain identical DER bytes. A fingerprint alone does not make a certificate trusted.
Read critical extensions carefully
A validator must understand every critical extension. Unknown critical entries are flagged while their original bytes remain available for investigation.