Decode a certificate without uploading it

X.509 certificates, signing requests, chains, revocation lists, keystores and raw ASN.1, read in your browser, on your machine. Nothing you paste leaves the page.

Decoded in this page. Nothing you paste leaves it.

Tip: / to jump here, Ctrl/⌘ + Enter to decode.

Decoding

Certificate decoder

Inspect every field of an X.509 certificate: subject, issuer, validity, SANs, key usage and fingerprints.

CSR decoder

Decode a PKCS#10 signing request: subject, public key, signature algorithm and requested extensions.

Chain decoder

Split a concatenated PEM bundle into an ordered chain and verify every issuer-to-subject link.

CRL decoder

Certificate Revocation List: revoked entries, dates and reasons.

PKCS#7 decoder

Inspect PKCS#7 / CMS bundles and the certificates they carry.

PKCS#12 decoder

Open password-protected .p12 / .pfx files.

Inspection

Fingerprints

Compute the SHA-1, SHA-256 and SHA-512 fingerprints of a certificate's DER.

ASN.1 viewer

Raw, expandable ASN.1 tree of any DER-encoded artefact.

Conversion

Format conversion

Convert PKI artefacts between PEM, DER and PKCS#7.

Generation

Self-signed certificate

Generate a self-signed certificate via WebCrypto, entirely in the browser.

Sign from a CA

Issue a certificate signed by an existing CA: new key pair or CSR, leaf or intermediate CA, with a ready-to-use fullchain.