X.509 Certificate Decoder
Free online X.509 certificate decoder. Paste a PEM or base64 DER certificate to inspect subject, issuer, validity, SANs, key type and fingerprints. 100% local — certificates never leave your browser.
What is an X.509 certificate?
X.509 is the standard format for SSL/TLS certificates that identify websites, servers and people. It binds a public key to a subject name and is signed by an issuer, forming chains of trust.
How do I decode a certificate online?
Paste the PEM text (the block starting with -----BEGIN CERTIFICATE-----) or raw base64 DER into the input. The decoder shows subject, issuer, validity, key info, SANs and fingerprints instantly.
Can I decode a full certificate chain?
Yes. Paste every PEM block of the chain and each certificate is decoded and listed separately, so you can follow the chain from the leaf to the root.
Are my certificates uploaded to a server?
No. Decoding happens entirely in your browser with the open-source Forge library. Nothing is transmitted, so even production certificates stay on your device.
What are the certificate fingerprints for?
SHA-1 and SHA-256 fingerprints are hashes of the whole certificate. They are used to compare certificates out-of-band, pin keys in clients, or verify a download is authentic.
What does the SAN field mean?
Subject Alternative Names list every hostname, IP or URI the certificate is valid for. Modern browsers ignore the common name and validate only against SAN entries.
What do the validity badges mean?
The tool compares the validity period to your device clock and marks each certificate as valid, expired, or not yet valid. Clock skew on your machine can change the result.
Which key and signature algorithms are supported?
RSA keys with MD5/SHA-1/SHA-256/SHA-384/SHA-512, RSASSA-PSS and ECDSA with SHA family digests are recognized. The public key size is shown in bits for RSA certificates.
How to Use X.509 Certificate Decoder
X.509 Certificate Decoder inspects SSL/TLS certificates entirely in your browser using the open-source Forge library. Certificates often contain production hostnames and internal names — here they are parsed locally and never uploaded.
- Paste the certificate text (the -----BEGIN CERTIFICATE----- block, several blocks for a chain, or raw base64 DER) into the input area. Parsing runs live as you type, or press Decode.
- Read the summary card for each certificate: subject and issuer distinguished names, serial number, validity window and a status badge marking it valid, expired or not yet valid.
- Check the signature algorithm and public key line — RSA key strength is shown in bits, ECDSA keys are labeled EC.
- Expand the Subject Alternative Names row to see every hostname, IP or URI the certificate covers.
- Click the SHA-1 or SHA-256 fingerprint to copy it to the clipboard for out-of-band comparison or key pinning.
Paste the whole chain (leaf, intermediates, root) at once — the decoder decodes every block separately so you can verify each issuer matches the next subject.
Related Tools
- Bcrypt Generator Generate and verify bcrypt password hashes online. Adjustable cost factor, built-in salt, real-time hash preview. All processing runs locally in your browser — no data sent to any server.
- RSA Key Generator Generate RSA key pairs with 2048, 3072, 4096 bit sizes. PEM format output with fingerprint. Runs entirely in your browser.
- JWT Decoder Free online JWT decoder. Decode JSON Web Tokens instantly to view header, payload and signature. No registration required.
- Hash Generator Generate MD5, SHA-1, SHA-256, SHA-512 hashes from text instantly in your browser
- File Hash Checker Calculate and verify MD5, SHA-1, SHA-256, SHA-512 file hashes locally
- PDF Unlock Remove password protection from PDF files instantly in your browser. Includes smart brute-force password recovery.
- Protect PDF Add password protection to PDF files online for free. Encrypt PDF documents with AES-256 encryption to prevent unauthorized access. 100% browser-based, no upload required.
- Basic Auth Header Generator Generate HTTP Basic Authentication headers online — encode username:password to Base64 Authorization header instantly