// TOOLS

Security Tools

📜 X.509 Certificate Decoder

Paste a PEM certificate and read it inside: subject, issuer, validity (and whether expired), serial number, signature algorithm, key type and size and the SANs. An in-house ASN.1 parser breaks it down in your browser: the certificate is never uploaded.

Frequently asked questions

Is the certificate I paste uploaded anywhere?
No. It is decoded in your browser with an in-house ASN.1/DER parser in JavaScript; the certificate never leaves your machine. In any case, a certificate is public information (it is presented on every TLS connection).
What format does it accept?
PEM: the text block between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----. If you have a binary DER or a .pfx/.p12, convert it to PEM first (for example with openssl).
Does it validate the trust chain or revocation?
No. This tool only decodes the contents of ONE certificate (subject, issuer, dates, key, SANs…). To check the chain, the protocol and a host's live status use the TLS/SSL Analyzer.
Why does it flag some certificates as weak?
It warns about SHA-1 signatures (deprecated) and RSA keys below 2048 bits, which are no longer considered secure. It also shows whether the certificate is expired, not yet valid or self-signed.