Paste or choose a certificate / CSR
Paste PEM text, or choose a .pem/.crt/.cer/.csr/.der file.
Paste a certificate or CSR above, or choose a file, to see its fields.
Decode certificates and CSRs, in your browser
This tool parses X.509 certificates and PKCS#10 certificate signing requests (CSRs) — PEM text or raw DER files — and shows their fields: subject, issuer, validity, Subject Alternative Names, public key, signature algorithm, and fingerprints.
A pasted PEM can contain more than one certificate — a chain. Each one is decoded on its own and listed separately, so you can click through a leaf certificate and its intermediates individually.
Why this matters for certificates
Certificates and CSRs are internal infrastructure detail, and people paste them — along with the occasional private key, by mistake — into whatever online decoder comes up first. Privacy here is structural, not a promise:
- Decoding runs entirely in your browser — there is no server to send anything to.
- Private key blocks pasted alongside a certificate are recognized and skipped — never parsed, never displayed.
- The page is served as static files and makes no request with your certificate data.
- The source is open and anyone can read it (MIT).
- It works offline, which is only possible because nothing leaves the device.
If you want to check for yourself, open your browser's Network panel while decoding — no request carries your certificate. Read the source.
How to use it
-
Paste or choose a file
Paste PEM text into the box, or choose/drop a .pem, .crt, .cer, .csr or .der file. PEM vs. raw DER is detected automatically.
-
Certificate or CSR is detected automatically
The tool tries parsing it as a certificate first, then as a CSR. A PEM with multiple certificates is shown as a chain you can click through.
-
Review the fields
A certificate shows subject, issuer, validity with an expiry badge, SANs, serial number, algorithms, and fingerprints; a CSR shows its requested subject, SANs, public key, and signature algorithm.
FAQ
Is my certificate or CSR uploaded anywhere?
No. Decoding runs entirely in your browser using the @peculiar/x509 library. There is no server component, so there is no path for your certificate data to leave your device. The source is open and you can confirm this in your browser's Network panel.
What if I accidentally paste a private key too?
Private key PEM blocks are recognized by their header and are never parsed or displayed — they're simply skipped, even if you paste a fullchain.pem and its key together.
What is a certificate chain, and why do I see a list?
A single PEM file can contain more than one certificate — typically a leaf certificate followed by one or more intermediate CAs. Each block is decoded independently and listed so you can inspect any of them.
What does the expiry badge mean?
It shows how many days remain until the certificate's notAfter date, or how many days have passed since it expired — color-coded: green while valid, amber inside the last 30 days, red once expired.
Can I decode a CSR (certificate signing request)?
Yes. If the input doesn't parse as a certificate, it's tried as a PKCS#10 CSR next. A CSR shows a different, smaller set of fields — requested subject, requested SANs, public key and signature algorithm — since a request has no issuer, validity period or fingerprint yet.
Does it work offline?
Yes. It's a PWA. After the first visit it's cached, so decoding works without a network connection. You can also install it to your home screen.
Does this tool generate certificates or CSRs?
No — this tool only decodes and displays existing certificates and CSRs; it does not create new ones.