CSR decoder: see what a certificate signing request asks for before it goes to a CA
Runs in your browser. Nothing you type is sent anywhere. Updated on 25 Oct 2026.A certificate signing request is written once, by a command with a lot of flags, and then sent to a certificate authority who charges for the mistake. The request is decoded here in your browser and never uploaded. The same check on the command line is openssl req -in request.csr -noout -text.
Open the page with an example signing request already decoded.
Paste your own CSR, or drop the .csr file onto the box.
Check the Subject and Names requested for a wrong country code or a Common Name with a protocol in it.
Read any warnings at the top of the card, then copy the SHA-256 of the request.
Decoding a certificate signing request first takes ten seconds and catches the usual three: a country code that is not two letters, a Common Name with a protocol or a slash in it, and a missing subjectAltName.
Paste a PEM block, or drop a .crt, .cer, .pem, .der or .csr file, and every field is listed: subject and issuer as full distinguished names, the serial in hex and in decimal, both validity dates with whether the certificate is in date at this moment, the signature algorithm, the public key algorithm and its size, every subject alternative name, the extensions with their critical flag, and the SHA-1 and SHA-256 fingerprints. The SHA-256 of the public key is given as well, in the sha256// form a pinning header wants.
Three shapes are read, and which one you have is worked out from the label on the BEGIN line rather than guessed. A certificate is read as RFC 5280 defines it. A PKCS#10 signing request is read including the names hidden inside its extensionRequest attribute, which is where a CSR keeps its SANs and where most decoders stop looking. A SubjectPublicKeyInfo is read on its own, so a key and the request it belongs to can be compared by fingerprint. Paste a whole chain and each certificate is read in order, with a note when the order is wrong.
The ASN.1 and DER parsing is written out in this repository rather than pulled from a library, so the code that reads your certificate can be read back. That also keeps the page small: no 300 KB crypto library is downloaded to walk a structure defined in two pages of ASN.1.
The rest of the article about Certificate Decoder is on the Certificate Decoder page.
On this page the request is decoded by code running in your browser and is never sent anywhere; the page makes no network request with it. A CSR holds the public key and the names being requested, while the private key stays on the server that made it. If a private key is pasted by mistake, the page names it as one and decodes nothing from it.
Run openssl req -in request.csr -noout -text in a terminal. It prints the same fields this page shows: the subject, the public key and its size, the requested extensions including subjectAltName, and the signature algorithm. Adding -verify also checks the request's signature. This page adds plain warnings that OpenSSL does not give, such as a missing subjectAltName or a weak key.
A CSR carries its subjectAltName inside a requested extension, and OpenSSL adds one only when its config file or the -addext "subjectAltName=DNS:example.com,DNS:www.example.com" option asks for it. Without it, some certificate authorities copy the Common Name into the certificate and others do not, and Chrome rejects a certificate with no subjectAltName. A new request listing every hostname fixes it.
This one reads the subject (Common Name, organisation and country), every hostname requested, the key type and size and the signature algorithm. It warns about what a certificate authority or a browser would refuse: a key that is too small, an MD5 or SHA-1 signature, no subjectAltName, or no hostname at all. Paste the issued certificate with the request and it says whether the two carry the same public key.
Still stuck? Ask about Certificate Decoder and anybody who knows can answer. No account needed.
Same job, other tools: JWT Decoder – Paste a token to read its header, payload and expiry.
On the related tools: Passphrase Generator – Three to ten random words you can actually remember · Bcrypt Generator – Generate a bcrypt hash for a test user or a config file.
In the collection Security Tools for Developers.