Certificate & CSR Decoder (X.509 / PKCS#10)

Certificates and certificate signing requests are dense, binary-encoded documents — pasting one into a random online decoder means trusting a stranger's server with a file that can contain your internal hostnames, your organization's legal name, or a public key you're about to submit to a certificate authority. This tool decodes X.509 certificates and PKCS#10 CSRs entirely inside your browser tab: the PEM text is base64-decoded to raw DER bytes locally, walked field by field with a genuine ASN.1 tag-length-value parser, and never transmitted anywhere.

Under the hood this is not a regex trick or a canned template — it's a real reader for the DER encoding rules defined in RFC 5280 (X.509) and RFC 2986 (PKCS#10): it reads each tag byte, decodes short-form and long-form lengths, recurses into SEQUENCE and SET constructions, and decodes primitive types like INTEGER, BIT STRING, OCTET STRING and OBJECT IDENTIFIER. Object identifiers are converted from raw bytes into dotted notation and matched against well-known values, so the output shows human-readable labels like CN, O and C for name fields, and RSA or EC for the public key algorithm, instead of a wall of numbers.

From a certificate, the tool extracts the version, serial number, issuer and subject distinguished names, notBefore/notAfter validity dates (with a plain-language valid/expired/not-yet-valid status), the public key algorithm and size — RSA modulus bit length or the named EC curve — and, when present, the Subject Alternative Name extension listing every DNS name, IP address, email or URI the certificate covers. From a CSR, it extracts the subject, public key and any Subject Alternative Names requested through the PKCS#9 extensionRequest attribute. A genuine SHA-256 fingerprint of the exact DER bytes is computed with the browser's native Web Crypto API and shown colon-separated, the same format most CA dashboards and openssl output use.

One thing this tool deliberately does not do: verify a chain of trust or check revocation status. Confirming that a certificate is signed by a trusted root, hasn't expired up the chain, or hasn't been revoked via OCSP or a CRL requires contacting a live certificate authority or OCSP responder over the network — and that kind of outbound request has no place in an offline, privacy-first decoder. This tool tells you exactly what is inside the certificate or CSR you pasted; it makes no claim about whether you should trust it.