Decode a TLS certificate you already have and see every field a browser looks at
Runs in your browser. Nothing you type is sent anywhere. Updated on 25 Oct 2026.An SSL certificate decoder shows what a browser checks: the names covered, the dates, the issuer and the key. The built-in example holds a 2048-bit RSA key signed with sha256WithRSAEncryption, 5 names in its SAN list and 3650 days of validity. Paste your PEM or drop the .crt; nothing is uploaded.
Open the page with an example certificate already decoded.
Paste the PEM from your server, or drop the .crt file onto the box.
Read Names this certificate covers, the Issuer and the Key strength row.
Compare the SHA-256 fingerprint with the one your browser shows for the live site.
Paste a PEM block, or drop a .crt, .cer, .pem, .der or .csr file, and every field is listed: subject and issuer as full distinguished names, the serial in hex and in decimal, both validity dates with whether the certificate is in date at this moment, the signature algorithm, the public key algorithm and its size, every subject alternative name, the extensions with their critical flag, and the SHA-1 and SHA-256 fingerprints. The SHA-256 of the public key is given as well, in the sha256// form a pinning header wants.
Three shapes are read, and which one you have is worked out from the label on the BEGIN line rather than guessed. A certificate is read as RFC 5280 defines it. A PKCS#10 signing request is read including the names hidden inside its extensionRequest attribute, which is where a CSR keeps its SANs and where most decoders stop looking. A SubjectPublicKeyInfo is read on its own, so a key and the request it belongs to can be compared by fingerprint. Paste a whole chain and each certificate is read in order, with a note when the order is wrong.
Warnings appear where they matter: an expired certificate, one under thirty days from expiry, SHA-1 or MD5 signatures, RSA keys below 2048 bits, a missing subjectAltName, a lifetime over the 398 days browsers allow, and what a wildcard name does and does not cover.
The rest of the article, and all 7 questions about Certificate Decoder, are on the Certificate Decoder page.
Paste the certificate and the validity line answers it: expired, valid, or valid with the number of days left, worked out against the clock on your own machine. Under thirty days raises a warning, because a certificate that lapses on a Saturday takes the site down until somebody notices.
Recognising one is supported; decoding it is refused on purpose. Nothing is sent anywhere, but a private key does not belong in a browser tab at all. If a key has been pasted into any website, generate a new one, reissue the certificate and revoke the old one.
Server se certificate ka PEM copy karein, paste karein, and every field appears at once: subject, issuer, expiry date, key size and fingerprints. Yeh check karein whether the expiry date has passed and whether every hostname you serve is listed under subject alternative names.
Chrome stopped reading the Common Name in version 58, released in 2017, and every other browser followed. A certificate without a subjectAltName extension listing each hostname is rejected however correct its CN is, so the warning is the actual reason a site shows an error.
Still stuck? Ask about Certificate Decoder and anybody who knows can answer. No account needed.
Same job, other tools: JWT Decoder – Paste a token to read its header, payload and expiry.
On the related tools: Passphrase Generator – Three to ten random words you can actually remember · Bcrypt Generator – Generate a bcrypt hash for a test user or a config file.
In the collection Security Tools for Developers.