X.509 Certificate Decoder

What is an X.509 certificate?

An X.509 certificate is a signed data structure that binds a public key to an identity. A certificate authority (CA) signs it, and clients trust it because they trust the CA. The certificate holds a subject name, an issuer name, a validity window, the public key, and a set of extensions such as subject alternative names and key usage.

Certificates are encoded with ASN.1 and serialized as DER. The DER bytes are usually wrapped in PEM, which is the same data encoded as Base64 between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- lines.

How to decode a certificate

1. Paste one or more PEM certificates, or a DER / Base64 certificate, into the input field. You can also drop a .pem, .crt, .cer, or .der file onto the drop area.
2. Select Decode. Decoding runs automatically when you load a file or the sample.
3. Review the summary: validity status, subject, and issuer.
4. Open any section to copy its values, or use Copy JSON / Download JSON for the full result.

A certificate chain pasted as several PEM blocks is split automatically. Use the certificate chain selector to switch between the leaf, intermediate, and root certificates.

Fields you will see

• Subject and issuer — the distinguished names, printed as their RDN attributes (CN, O, OU, C, ST, L, and so on).
• Validity — the not-before and not-after timestamps plus the computed duration and current status.
• Public key — the algorithm, key size, and, for EC keys, the named curve.
• Subject alternative name (SAN) — the DNS names, IP addresses, email addresses, and URIs the certificate is valid for.
• Key usage / extended key usage — what the key may be used for, such as digital signature, key encipherment, or TLS server authentication.
• Basic constraints — whether the certificate is a CA and any path length limit.
• Fingerprints — SHA-1 and SHA-256 digests of the DER encoding, shown in the usual colon-separated form.
• Extensions — every extension, including the raw value for ones this tool does not parse by name.

DER to PEM and PEM to DER

The same certificate can be stored in binary DER or Base64 PEM. This tool reads both. Download PEM re-wraps the selected certificate as PEM, and Download DER exports the raw bytes, so you can convert between the two formats without leaving the page.

Decoding is not verification

Decoding only parses the fields that are visible in the certificate. It does not verify the signature, build or validate a trust chain against a certificate store, check revocation (CRL or OCSP), or confirm that the key holder is the named identity. A certificate with a valid look and a future expiry date can still be self-signed, revoked, or issued by an untrusted CA.

For real trust decisions, verify the chain with the platform or library that will consume the certificate, and check revocation on the network.

Privacy

Certificates are parsed entirely in your browser and are never uploaded to this site's server. Certificates are public by design, but a private key, an internal hostname, or an internal email address that appears in a certificate can still be sensitive, so avoid sharing screenshots or logs casually.

Frequently asked questions

Can this tool tell me whether a certificate is trusted?

No. It shows the declared validity window and status, not whether a trust store accepts the chain or whether the certificate was revoked.

Why does the same certificate have two fingerprints?

SHA-1 and SHA-256 both hash the DER bytes but produce different digests. Modern systems use the SHA-256 fingerprint.

Can I decode an encrypted private key here?

No. This tool decodes certificates, not private keys, and it never asks for a passphrase.