FormatterHQ
JSON Tools XML Tools YAML Tools CSV & TSV Tools HTML Tools CSS Tools JavaScript Tools SQL Tools Code Formatters & Beautifiers Minifiers Validators Data Converters Data to Class Generators Escape & Unescape Encode & Decode Base64 Tools Hash & Cryptography String & Text Utilities Number Converters Color Converters Unit Converters IP & Network Tools Random Data Generators Diff & Compare Viewers & Editors Image Tools PDF Tools Markdown Tools SEO & Webmaster Tools Developer Utilities JSON Formatter PDF Tools XML Formatter Beautifiers Converters Blog

SSL Certificate Decoder (X.509)

Paste a PEM certificate or upload a .crt, .cer or .der file to see who it was issued to, which names it covers, when it expires and what its fingerprints are.

Input TEXT
Output TEXT
Ready.

How to use the SSL Certificate Decoder (X.509)

  1. Paste a certificate that starts with -----BEGIN CERTIFICATE-----, or upload a .pem, .crt, .cer or .der file. Base64 or hex DER also works.
  2. Choose the Output: Readable report for people or JSON for scripts.
  3. Click Decode certificate. If you pasted a full chain, each certificate is decoded in order.
  4. Check the Status, Names (SAN) and fingerprints, then copy the report.

An SSL certificate decoder that works offline

This ssl certificate decoder reads an X.509 certificate and lays out every field in plain text: subject, issuer, validity dates, serial number, public key, extensions and fingerprints. Use it to confirm that a certificate covers the right hostnames before you deploy it, to find out when a certificate expires, or to understand a chain a server is sending.

What is an X.509 certificate?

An X.509 certificate binds a public key to a name. A certificate authority (CA) signs a structure containing the subject name, the key, a validity period and a list of extensions. TLS servers, code-signing tools, VPN clients and SAML identity providers all use the same format.

PEM files (.pem, often .crt) are Base64 text between BEGIN CERTIFICATE and END CERTIFICATE lines. DER files (.der, often .cer) hold the same bytes in binary. The decoder accepts both, plus raw Base64 or hex.

Example

Decoding the sample EC certificate gives a report like this (shortened):

Subject:        C=US, ST=California, L=San Francisco, O=Example Inc, CN=www.example.com
Issuer:         C=US, ST=California, L=San Francisco, O=Example Inc, CN=www.example.com   (self-signed)
Valid from:     2026-09-25 20:20:13Z
Valid until:    2028-12-28 20:20:13Z
Status:         valid (824 days left)
Signature:      ecdsa-with-SHA256
Public key:     EC 256 bit (prime256v1 (P-256))
Names (SAN):    DNS:www.example.com, DNS:example.com, DNS:api.example.com

Fingerprints:
  SHA-256: 6C:43:F6:9E:31:85:35:7E:3F:99:72:50:79:15:E9:06:…
  SPKI SHA-256 (pin, Base64): +RnN6DiU20GQfUlFc8WFs8QbSuUosWM0FIl274Q0g9U=

Fields explained

  • Status: compares the validity dates with your computer's clock and shows valid with the days left, EXPIRED or not yet valid.
  • Names (SAN): the Subject Alternative Names. Browsers match the hostname against this list, not the Common Name, so a missing SAN is a common reason for a name mismatch error.
  • Extensions: key usage, extended key usage (for example serverAuth), basic constraints (whether the certificate is a CA), key identifiers, CRL distribution points, Authority Information Access (OCSP and CA issuer URLs), policies and the number of embedded Certificate Transparency SCTs.
  • Fingerprints: SHA-256 and SHA-1 over the whole certificate, plus a Base64 SHA-256 of the public key (SPKI). The SPKI hash is the value used for certificate pinning, and it stays the same when a certificate is renewed with the same key.

The JSON output holds the same data as an object, which is useful when you want to compare two certificates in a diff or process them in a script.

Decoding a certificate chain

Paste several PEM blocks at once, for example the contents of a fullchain.pem file, and each certificate is decoded under its own heading. Read the issuer of one certificate and the subject of the next to check that the chain is in order: leaf first, then each intermediate. Certificate requests in the same paste are skipped. Use the CSR decoder for those.

Common errors and fixes

  • "No certificate found": the text is a key or a CSR, or the BEGIN line is missing. Copy the whole block, including both dashed lines.
  • "This is not an X.509 certificate": the bytes are valid DER but hold something else. Inspect them with the ASN.1 decoder.
  • Base64 errors: email clients sometimes add spaces or break lines. Line breaks are fine, but other characters inside the block are not.

To get the certificate a live server presents, run openssl s_client -connect example.com:443 -showcerts and paste the PEM blocks from the output.

Privacy

The certificate is parsed in your browser by a built-in ASN.1 reader, and fingerprints are computed with WebCrypto. Nothing is uploaded. The tool does not contact the issuing CA, so it does not check revocation or validate the chain up to a trusted root. For JWT signing certificates, pair it with the JWT verifier.

Frequently asked questions

Can this tool check whether a certificate is trusted or revoked?
No. It decodes and reports the fields, but it does not build a trust path to a root CA or query OCSP and CRL servers. Use your server or browser for trust checks, and the decoder to see why a certificate might fail them.
How do I open a .cer or .der file?
Upload the file directly. Binary DER is detected automatically, and a .cer that actually contains PEM text also works.
Why does my browser say the name does not match when the Common Name is correct?
Modern browsers ignore the Common Name and only check the Subject Alternative Name list. If the hostname is not in Names (SAN), reissue the certificate with that name added as a SAN.
What is the SPKI SHA-256 fingerprint used for?
It is a hash of the public key rather than the whole certificate. HTTP public key pinning, mobile app pinning and some VPN clients use it because it survives a renewal that keeps the same key.
Can I decode a certificate from a PKCS#12 (.pfx or .p12) file?
Not directly, because PKCS#12 files are password-protected containers. Extract the certificate first with openssl pkcs12 -in file.pfx -nokeys, then paste the PEM output.

Last updated October 3, 2026

Guides

How to Decode a SAML Response and Read What It Says Capture a SAMLResponse or SAMLRequest in your browser, remove its Base64 and DEFLATE layers, and read the fields that explain most single sign-on failures.

Related tools

Self-Signed Certificate Generator Create a self-signed SSL/TLS certificate and RSA key for localhost, dev servers or internal tools. Generated locally with WebCrypto. ASN.1 Decoder Parse DER/BER ASN.1 structures from PEM, Base64 or hex into a readable tree with OID names, strings, times and integers. CSR Decoder Decode a PKCS#10 certificate signing request to check the subject, SANs, key size and signature before you send it to a CA. MongoDB ObjectId to Timestamp Extract the creation date from MongoDB ObjectIds and see the random and counter parts; also builds a date-range _id query. SAML Response Decoder Decode Base64 or deflated SAMLResponse and SAMLRequest messages into readable XML and summarise issuer, NameID, conditions and attributes. Snowflake ID Decoder Convert Twitter/X, Discord, Instagram and other Snowflake IDs to timestamps and show worker, process and sequence bits. xxHash Generator Generate xxHash XXH32, XXH64, XXH3 and XXH128 hashes with an optional seed. Adler-32 Hash Generator Generate the Adler-32 hash of any text or file online. Instant 32-bit checksum in hex, computed in your browser. Argon2 Hash Generator Hash and verify passwords with Argon2id, Argon2i or Argon2d using custom memory, iterations and parallelism. Runs locally via WebAssembly. Bcrypt Hash Checker Check whether a password matches a bcrypt hash, like PHP password_verify, entirely in your browser. Bcrypt Hash Generator Generate a bcrypt password hash ($2y$) with a configurable cost factor, compatible with PHP password_hash and Laravel. BLAKE2b Hash Generator Generate BLAKE2b hashes (128–512 bits) with optional keyed MAC mode, from text or files.