X.509 Certificate Decoder
Inspect X.509 certificate fields such as subject, issuer, validity dates, SANs, key usage, public key, signature algorithm, and SHA-256 fingerprint without uploading the certificate.
This decodes certificate information only. It does not validate trust, hostname, DNS, revocation, or certificate chains.
Results
This decodes certificate information only. It does not validate trust, hostname, DNS, revocation, or certificate chains.
How to read an X.509 certificate
Paste or load a PEM/DER certificate to inspect its subject, issuer, validity period, public key, fingerprint, and common extensions.
Certificate information
The decoder reads fields encoded inside the certificate itself, such as Subject, Issuer, serial number, validity dates, Subject Alternative Names, Key Usage, and Basic Constraints.
Trust is different
A certificate can be decoded without proving that it is trusted for a domain. Trust requires hostname context, a certificate chain, revocation information, and platform trust roots, none of which this local decoder verifies.
Common uses
- Check when a certificate expires.
- Inspect SAN entries before configuring TLS.
- Compare issuer and public key details during debugging.
Processing notes
Certificate parsing and fingerprinting run in your browser; the certificate is never uploaded.
FAQ
Does this prove a certificate is trusted?
No. It decodes certificate data but does not validate trust, hostname, DNS, revocation, or certificate chains.
Can I load DER certificates?
Yes, DER files can be loaded from your device and parsed locally when they are not malformed.
What is the SHA-256 fingerprint?
It is a digest of the certificate bytes, useful for comparing certificates without sharing the full certificate.