FormatterHQ
JSON Tools XML Tools YAML Tools CSV & TSV Tools HTML Tools CSS Tools JavaScript Tools SQL Tools Code Formatters & Beautifiers Minifiers Validators Data Converters Data to Class Generators Escape & Unescape Encode & Decode Base64 Tools Hash & Cryptography String & Text Utilities Number Converters Color Converters Unit Converters IP & Network Tools Random Data Generators Diff & Compare Viewers & Editors Image Tools PDF Tools Markdown Tools SEO & Webmaster Tools Developer Utilities JSON Formatter PDF Tools XML Formatter Beautifiers Converters Blog

CSR Decoder

Paste a certificate signing request to confirm the domain names, organization details and key before you submit it to a CA. The tool also checks the CSR signature.

Input TEXT
Output TEXT
Ready.

How to use the CSR Decoder

  1. Paste the CSR, starting with -----BEGIN CERTIFICATE REQUEST-----, or upload a .csr, .req or .pem file.
  2. Pick the Output format: Readable report or JSON.
  3. Click Decode CSR.
  4. Check the subject fields, Names (SAN), key size and the signature line before you submit the request.

Check your request with a CSR decoder

A certificate signing request (CSR) is what you send to a certificate authority when you order an SSL/TLS certificate. Mistakes in it, such as a missing hostname, a misspelled organization or a weak key, end up in the issued certificate. This csr decoder shows exactly what the request contains so you can fix problems before the CA sees them.

What is inside a CSR?

A CSR uses the PKCS#10 format. It contains a subject name (country, state, city, organization, common name and so on), the public key of the key pair you generated, and optional attributes. The most important attribute is the extension request, which carries the Subject Alternative Names you want in the certificate. The whole structure is signed with the matching private key, which proves to the CA that you hold that key.

Example

Decoding the sample request produces:

Subject:        C=GB, ST=London, L=London, O=Acme Widgets Ltd, OU=IT, CN=shop.acme-widgets.co.uk, emailAddress=admin@acme-widgets.co.uk
  countryName (C)                    GB
  organizationName (O)               Acme Widgets Ltd
  commonName (CN)                    shop.acme-widgets.co.uk
  …
Public key:     RSA 2048 bit
Signature:      sha256WithRSAEncryption — valid (proves possession of the private key)
Names (SAN):    DNS:shop.acme-widgets.co.uk, DNS:www.shop.acme-widgets.co.uk

The report ends with a SHA-256 hash of the public key. The same key hash appears, Base64-encoded, as the SPKI fingerprint in the certificate decoder, which lets you confirm that an issued certificate was made from this request's key.

What the decoder checks

  • Signature: the self-signature is verified with WebCrypto for RSA (PKCS#1 v1.5), ECDSA P-256/P-384/P-521 and Ed25519 requests. INVALID means the CSR was edited after signing or is damaged.
  • Subject Alternative Names: if none are requested, the report says so. Public CAs build the certificate's name list from SANs, and most expect at least one.
  • Key size: RSA keys under 2048 bits trigger a warning, because public CAs reject them.
  • Other attributes: values such as a challenge password or unstructured name are listed separately from the requested extensions.

Common problems and fixes

  • Only the common name is set: add the bare domain and the www name as SANs. When you create the request with the CSR generator, the common name is added to the SAN list for you.
  • Wrong country value: the C field must be a two-letter ISO code, such as US or GB, not a country name.
  • "This is not a PKCS#10 certificate signing request": you pasted a certificate or a key. Certificates start with BEGIN CERTIFICATE, while requests start with BEGIN CERTIFICATE REQUEST or the older BEGIN NEW CERTIFICATE REQUEST. Both request headers are accepted.
  • Signature could not be checked: the algorithm is not one WebCrypto supports, such as DSA or RSA-PSS. The rest of the report is still accurate.

CSR vs certificate

A CSR is a request: it has no issuer, no serial number and no validity dates, and the CA can ignore or override fields in it. The certificate you receive back is what clients actually trust. Decode both and compare the subject and SAN lines to make sure the CA issued what you asked for. For a deeper look at the raw structure, open the request in the ASN.1 decoder.

Privacy

A CSR contains only public information, but it is still processed entirely in your browser. Parsing is done by a built-in ASN.1 reader and signature checks use WebCrypto, so nothing is uploaded.

Frequently asked questions

Is it safe to paste a CSR into an online decoder?
Yes. A CSR contains your public key and subject details, which end up in the public certificate anyway. It never contains the private key. This decoder also runs in your browser, so the request is not uploaded.
How can I tell whether a CSR matches my private key?
Compare public key hashes. The decoder shows a SHA-256 of the CSR public key. You can print the same value from your key file with openssl, or decode the certificate issued from it and compare the SPKI fingerprint.
Does the CSR need the www and non-www names?
If visitors use both, yes. Put both names in the SAN list. Some CAs add the www variant automatically, but it is safer to request exactly the names you need.
Why does my CSR show version 1 (value 0)?
PKCS#10 defines only one version, and it is encoded as the number 0. Every valid CSR shows this value, so it is not an error.
Can I decode an ECDSA CSR?
Yes. EC requests on P-256, P-384 and P-521, as well as Ed25519 requests, are decoded and their signatures verified. The public key line shows the curve name and size.

Last updated October 3, 2026

Related tools

CSR Generator Generate an RSA private key and certificate signing request (CSR) with SANs in your browser — the private key never leaves your device. ASN.1 Decoder Parse DER/BER ASN.1 structures from PEM, Base64 or hex into a readable tree with OID names, strings, times and integers. MongoDB ObjectId to Timestamp Extract the creation date from MongoDB ObjectIds and see the random and counter parts; also builds a date-range _id query. SAML Response Decoder Decode Base64 or deflated SAMLResponse and SAMLRequest messages into readable XML and summarise issuer, NameID, conditions and attributes. Snowflake ID Decoder Convert Twitter/X, Discord, Instagram and other Snowflake IDs to timestamps and show worker, process and sequence bits. ULID Decoder Decode ULIDs to their embedded timestamp and random part, and convert between ULID and UUID formats. ECDSA & Ed25519 Key Generator Generate elliptic-curve key pairs (P-256, P-384, P-521) and Ed25519 keys as PEM or JWK for JWT signing, TLS and APIs. Encrypt & Decrypt Text Encrypt or decrypt text with AES, Triple DES, Rabbit, RC4 or Blowfish using a secret passphrase — in your browser. Hash Identifier Identify hash types from their format: MD5, SHA-1/256/512, bcrypt, Argon2, sha512crypt, NTLM, MySQL, phpass, Django and more. HMAC Generator Generate HMAC-SHA256, HMAC-SHA1, HMAC-SHA512, HMAC-MD5 and SHA-3 HMACs with a secret key, as hex or Base64. Htpasswd Generator Create .htpasswd entries for Apache and Nginx basic auth with bcrypt, APR1-MD5 or SHA-1 — one username:password per line. Keccak Hash Generator Generate original Keccak-224/256/384/512 hashes, including the Keccak-256 used by Ethereum and Solidity.