Certificate & CSR Decoder

Decode X.509 certificates & CSRs locally — subject, issuer, SANs, validity.

Decode an SSL/TLS certificate or CSR and read its subject, SANs, issuer, validity and key. Free X.509 decoder that runs in your browser — nothing uploaded.

About Certificate & CSR Decoder

Certificate & CSR Decoder is a free, browser-based tool that parses a PEM-encoded X.509 certificate or PKCS#10 certificate signing request and shows its details in plain language — subject, issuer, serial number, validity dates with days-remaining, public-key algorithm and size, signature algorithm, and Subject Alternative Names (SANs). Parsing runs entirely on your device using the pkijs and asn1js libraries, so it works for inspecting a server cert before deploy, checking expiry, or confirming the SANs in a CSR you generated. Nothing is uploaded and there is no signup — your certificates, CSRs, and keys never leave the browser.

How to use Certificate & CSR Decoder

  1. Paste a PEM block into the input box — an X.509 certificate that starts with -----BEGIN CERTIFICATE----- or a request that starts with -----BEGIN CERTIFICATE REQUEST-----.
  2. Or click 'Load sample' to drop in an example certificate and see how the output looks.
  3. Read the decoded details on the right: type and validity status chips, the summary stats (public key, key size, signature algorithm, SAN count), and rows for subject, issuer, serial, and not-before/not-after dates.
  4. Scroll to the Subject Alternative Names table to see every DNS name, IP, or email listed in the certificate or CSR's SAN extension.
  5. Use the small copy buttons beside each field to copy a value, and click 'Clear' to wipe the input and start over.

Frequently asked questions

Are my certificates or private keys uploaded to a server?
No. Decoding happens entirely in your browser with the pkijs/asn1js libraries — your certificates, CSRs, and keys are read and parsed locally and never leave your device.
Is it free and do I need an account?
Yes, it is completely free with no signup, account, or limits on how many certificates you decode.
What formats does it accept?
PEM-encoded input: an X.509 certificate (BEGIN CERTIFICATE) or a PKCS#10 certificate signing request (BEGIN CERTIFICATE REQUEST). Raw binary DER files are not accepted directly — paste the Base64 PEM text instead.
Can I decode a full certificate chain or bundle?
It decodes one block at a time. If you paste a chain or bundle, it parses the first PEM block, tells you how many additional blocks it detected, and asks you to paste a single block to decode another.
What does it show for a CSR versus a certificate?
For a certificate you get subject, issuer, serial, validity dates with a Valid/Expired/Not-yet-valid status and days remaining, plus key and signature details and SANs. A CSR has no issuer, serial, or validity, so those fields are omitted and you see the subject, public-key info, signature algorithm, and any SANs from its extensionRequest attribute.
Is there a size limit on the input?
Yes, the input is capped at 200,000 characters — far more than any real certificate or chain needs — to keep the synchronous parse fast and responsive.

People also search for

Certificate & CSR Decoder is also known as x509 certificate decoder, certificate decoder online, decode ssl certificate, csr decoder, view x509 certificate fields, pem certificate decoder, read certificate details.