Skip to content
TextArray1.41.0
100% local

X.509 certificate decoder

Decode a PEM certificate and inspect its subject, issuer, validity, extensions and fingerprint.

Input
Output
Related tools
JWT decoderDeveloper tools
Hash generatorDeveloper tools
Base64 encode and decodeEncoding & conversion
i18n key diffDeveloper tools
TOML to JSON converterDeveloper tools
SQL to JSONDeveloper tools
X.509 certificate decoder
Paste a PEM-encoded X.509 certificate and this tool reads its structure directly in your browser: subject, issuer, serial number, validity dates, signature algorithm, subject alternative names and a SHA-1 or SHA-256 fingerprint. It's built for the moments a certificate lands in your terminal or inbox and you need to know what's actually in it — debugging a TLS handshake, checking a certificate before it goes on a server, or auditing a chain someone sent you.
The options control how much detail comes back. "List all certificates in the chain" decodes every block in a pasted bundle, not just the first one. "Show days remaining" adds a countdown to expiry and flags anything due within 30 days. "Show extensions" prints key usage and basic constraints — whether the certificate is allowed to act as a CA. Pick SHA-1 or SHA-256 for the fingerprint, and switch the output between a readable overview and structured JSON for feeding into a script.
The tool also flags a self-signed certificate — one whose subject and issuer match exactly — which is normal for a root CA but worth a second look anywhere else in a chain. Decoding only parses the certificate's own DER structure; it does not verify the signature, check the issuing CA, or query a revocation list, so a certificate can decode cleanly while still being untrusted, expired in spirit, or outright forged.
Everything happens locally. The certificate never leaves your device, which matters since production certificates and internal PKI chains are often not meant for public sharing. Copy the report, download it as a .txt file, or send the output back into the input to inspect the next certificate in a chain.
FAQ
Does this tool verify the certificate's signature or trust chain?
No. It only parses and displays the fields inside the certificate — it does not check the signature, validate the issuing CA, or query a revocation list.
What counts as "expiring soon"?
A certificate valid for 30 days or fewer from today is flagged, so a renewal doesn't slip past unnoticed.
Why does a self-signed certificate get a warning?
A self-signed certificate has an identical subject and issuer. That is expected for a root CA, but it often signals an internal or test certificate that browsers elsewhere will not trust automatically.
Does it work with a full certificate chain, not just one certificate?
Yes. Paste multiple PEM blocks and turn on "List all certificates in the chain" to decode each one in order.
Is my certificate uploaded anywhere?
No. The certificate is parsed entirely in your browser and never leaves your device.