Paste an SSL/TLS certificate to decode X.509 details, validity dates, SANs, key info, and fingerprints locally.
PEM certificate blocks and Base64 DER certificate text are supported. Hosts are never contacted.
Decoder only. This tool does not connect to domains, fetch live certificates, check OCSP or CRL status, or validate TLS handshakes.
Paste a certificate to decode
The decoder will summarize X.509 fields, validity dates, SANs, fingerprints, and common extensions.
Certificate guide
Inspect certificate identity, validity, SANs, fingerprints, and common extensions from pasted certificate text.
X.509 certificates contain the subject, issuer, serial number, validity window, signature algorithm, public key details, fingerprints, SANs, and extensions used by TLS clients and servers.
PEM wraps Base64 DER bytes between certificate headers. DER is the binary certificate format. This decoder accepts PEM blocks and plain Base64 DER text when the certificate bytes are practical to paste.
The subject names the certificate identity, while the issuer names the certificate authority or self-signed certificate that issued it. These values are decoded only from the pasted certificate.
Modern TLS name checks rely on Subject Alternative Name entries such as DNS names, IP addresses, email addresses, and URIs. The common name alone is not enough for hostname matching.
The not-before and not-after fields define when a certificate can be used. This decoder flags expired certificates and certificates whose validity window has not started yet.
SHA-256 and SHA-1 fingerprints are hashes of the certificate DER bytes. SHA-256 is preferred for modern comparisons; SHA-1 is shown for legacy systems and inventories.
A decoder reads certificate text you paste. A live TLS checker connects to a host and evaluates the deployed certificate chain. This page intentionally does not make those network connections.
If you paste multiple PEM certificate blocks, each block is decoded separately so you can inspect leaf, intermediate, and root certificate fields side by side.
Certificates are public, but private keys are secrets. If private key material is pasted by mistake, the decoder warns and ignores the private key block.
No. It only decodes pasted certificate text and does not connect to hosts, validate live TLS, or call external APIs.
Yes. Paste multiple PEM certificate blocks and the decoder will show each certificate in the chain separately.
No. The decoder shows certificate fields and warnings for validity dates, but it does not build a trust path, check revocation, or verify browser trust stores.
Use SHA-256 for modern certificate comparisons. SHA-1 is included because some older systems and inventories still display it.