Loading tool...
Generate Certificate Signing Requests (CSR) for SSL/TLS certificates with RSA key pairs. Submit to CAs for certificate issuance
Convert certificates and keys between PEM (Base64) and DER (binary) formats. Supports certificates, keys, and CSRs
Generate self-signed SSL/TLS certificates for local development and testing. Includes Subject Alternative Names support
Your CI pipeline just failed with a cryptic certificate error, and you need to know what's inside that PEM file right now. Paste a certificate and see every field decoded: subject, issuer, validity dates, SANs, key algorithm, signature, extensions, and chain details.
X.509 certificates pack a lot of structured data into a Base64-encoded blob. This decoder parses all of it: the subject and issuer distinguished names, serial number, validity period, public key algorithm and size, Subject Alternative Names (SANs), key usage, extended key usage, authority and subject key identifiers, CRL distribution points, OCSP responder URLs, and certificate policies. It also identifies common issues like expired certs, weak key sizes, and mismatched SANs.
Decode the certificate to verify the SANs include the hostname you're connecting to.
Confirm a renewed certificate has the correct validity dates, key size, and extensions before deployment.
Check certificates across your infrastructure for weak algorithms, short keys, or missing required extensions.
Examine certificates provided by third parties before installing them in your trust store.
PEM format — the text block surrounded by -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- markers.
Yes. Paste the full chain and each certificate in the chain will be decoded separately.
No. Decoding happens entirely in your browser.
All processing happens directly in your browser. Your files never leave your device and are never uploaded to any server.