X.509 Certificate (PEM) Decoder
Paste a PEM (-----BEGIN CERTIFICATE-----) such as an SSL/TLS server certificate to see its issuer, validity dates, SANs, public key, and SHA-256 fingerprint. Everything runs in your browser, and the certificate is never sent to a server.
🔒 Runs in your browser · Your data is never sent to a server
Notes
- This tool does not verify the signature or the certificate chain, and does not check revocation (CRL/OCSP). It only reads and displays the contents, so it cannot tell you whether a certificate is trustworthy.
- The validity status is judged against the current time on your device.
- If you paste several certificates together (for example a server certificate and an intermediate), all of them are shown in order.
- Do not paste a private key (-----BEGIN PRIVATE KEY-----). This tool only handles certificates and cannot read private keys.
Glossary
X.509
The standard format for public-key certificates used in SSL/TLS and elsewhere. It holds the owner (subject), the issuer, the validity period, the public key, and more.
PEM
A text format that wraps the Base64 of the binary (DER) certificate between "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE-----" lines.
SAN (Subject Alternative Name)
The list of domain names and IP addresses a certificate is valid for. Modern browsers check the hostname against the SAN, not the CN (common name).
Fingerprint
A hash of the whole certificate. It identifies a certificate uniquely and is used to compare against a value received through another channel to detect tampering or mix-ups.
FAQ
How do I get the PEM of a server certificate?
You can export it from the certificate viewer behind the padlock icon in your browser, or run "openssl s_client -connect example.com:443 -showcerts" and copy everything from "-----BEGIN CERTIFICATE-----" to "-----END CERTIFICATE-----" as is.
Does it tell me whether a certificate is trustworthy?
No. This tool only reads and displays what is inside the certificate. It does not verify the signature or chain, or check revocation. The validity status is a simple comparison with your device's current time.
It says "Expired" but the site loads fine. Why?
The certificate you pasted may be an older one rather than the one the site currently serves. Fetch the renewed certificate and check again. A wrong clock on your device can also change the result.
Can it read DER files or PKCS#12 (.pfx) bundles?
No. Only PEM (or Base64 without the header lines) is supported. Convert a DER file first with "openssl x509 -inform der -in cert.der -out cert.pem", then paste the result.
Share this page